Guide · ISO 9001, 14001, 45001 and other certified systems
Major nonconformity: what happens next.
A major nonconformity is not a failed audit. It is a finding your certification body will not close until you have fixed the problem, found its cause and shown that the fix works. Here is what it means, what the clock is, and how to answer it so you are not back here at the next audit.
Last verified October 5, 2026
- What it is
- A finding that affects your system's ability to achieve its intended results — usually a required element missing or not working.
- Who sets the deadline
- Your certification body. The standard only says “within a defined time.” Check your nonconformity report.
- What closes it
- Correction, cause, corrective action — accepted by the certification body, and its effectiveness verified.
- The worst case
- Suspension if it stays unresolved after a surveillance audit; no certificate at an initial audit; no extension at recertification.
Major or minor: where the line is
Every accredited certification body grades findings against the definitions in ISO/IEC 17021-1, the standard that governs how they certify. A major nonconformity is one that affects the capability of the management system to achieve its intended results. A minor nonconformity is one that does not.
Two things push a finding to major. The first is a required element that is missing or not functioning, so that there is real doubt the process is under control. The second is a pattern: several minor nonconformities against the same requirement can be graded together as one major, because together they show the system is not working rather than that someone slipped once.
| Typically graded major | Typically graded minor |
|---|---|
| No internal audit for well over a year | One internal audit report missing a signature |
| No management review held since the last audit | A management review that skipped one required input |
| Quality objectives set, but no performance data collected | One objective without a target date |
| No control of nonconforming product on the shop floor | One rejected part not tagged |
| A calibration program nobody is running | One gauge missing from the calibration log |
| Customer complaints logged but never investigated | One complaint closed without a recorded investigation |
| No evaluation of the suppliers that affect product quality | One supplier overdue for re-evaluation |
| Corrective actions closed with no check that they worked | One corrective action closed a week early |
These are patterns, not rules. Grading is the auditor's judgment against the definition, and the same gap can land either side of the line depending on how far it reaches.
What happens, step by step
- At the closing meeting. The auditor presents each finding with the requirement, the grade and the objective evidence. This is the moment to correct a factual error: if a record exists that the auditor did not see, show it now. Before you leave, make sure you know the deadline for your response.
- Within your certification body's deadline. You submit your correction, your analysis of the cause and your corrective action. ISO/IEC 17021-1 (clause 9.4.9) requires the certification body to ask for these “within a defined time,” and leaves the time to the certification body. As one published example, Schellman asks for a plan within 14 days, evidence of correction within 30 and, for a major, evidence of remediation within 60.
- The certification body reviews and verifies. It decides whether your response is acceptable, then verifies that the corrective action is effective (clause 9.4.10). That can be done from documents you send, or on site. You will be told whether a further visit is needed; additional audit time is normally charged.
- Then it depends on which audit raised it.
| Audit | What the standard requires |
|---|---|
| Initial certification (stage 2) | No certificate until the majors are closed. If the certification body cannot verify the corrections and corrective actions within 6 months of the last day of stage 2, it must conduct another stage 2 before recommending certification (9.5.3.2). |
| Surveillance | The certification body must suspend certification when a certified organization fails to meet certification requirements (9.6.5.2). Under suspension the certificate is temporarily invalid; it is restored when the issue is resolved, and the standard notes suspension would not normally exceed six months. Unresolved, it ends in withdrawal or a reduced scope. |
| Recertification | Corrections and corrective actions for majors must be completed before your current certificate expires (9.6.3.2.2). If not, recertification is not recommended and the certificate is not extended. After expiry, certification can be restored within 6 months if the outstanding activities are completed; otherwise at least a stage 2 is needed (9.6.3.2.5). |
Closed is not the same as fixed
The most expensive majors are the ones that come back. They come back for one reason: the response fixed the event and not the routine.
Take a pair of majors we see often: no internal audit and no management review for over a year, usually after the person who ran the system left. The quick response is to hold one internal audit and one management review, send in the records, and close both findings. That is a correction. It is necessary, and it is not enough. Twelve months later nobody owns the next audit, the review slips again, and the next auditor — who will look at how the last findings were closed — finds the same gap.
The corrective action answers a different question: why did a required routine stop without anyone noticing? The answer is almost never “someone forgot.” It is that the routine had no owner, no date in anyone's calendar, and nothing that would flag it as late. Fix that, and the finding stays closed.
A response that closes a major
- Correction, with evidence. What you did about the problem itself, and when. Records, not assertions.
- Extent. Where else the same gap could exist. If one process skipped its review, check the others before the auditor does.
- Root cause, at the level of the system. Keep asking why until the answer is something you can change: ownership, scheduling, resourcing, process design. “Human error” and “employee retrained” are where analysis stops too early.
- Corrective action, with an owner and a date. One named person, one deadline, per action.
- How you will know it worked. The check you will make, and when. This is what the certification body verifies, and what the next auditor will look for.
What not to do
- Do not wait for the deadline. The certification body has to review your response, and if it is not accepted you need time to rework it.
- Do not answer a system failure with a document. Rewriting a procedure that nobody followed changes the procedure, not the behavior.
- Do not argue the grade without evidence. Show what exists. If you still disagree, use the appeals process every accredited certification body must have.
- Do not let the people who missed it write the root cause alone. They are the least likely to see the system around them.
If you are holding a major right now, the deadline matters more than anything on this page. Tell us the finding and the date — a short call is enough to say whether your response will close it. For the routine that prevents the next one, see our internal audit service.
Common questions
What is a major nonconformity?
ISO/IEC 17021-1, the standard accredited certification bodies work to, defines a major nonconformity as one that affects the capability of the management system to achieve its intended results. In practice that usually means a required element is missing or not working: no internal audits, no management review, no control of nonconforming product. A cluster of minor nonconformities against the same requirement can also be graded major, because together they show a systemic failure rather than a one-off slip.
How long do we have to respond to a major nonconformity?
Your certification body sets the deadline, not the standard. ISO/IEC 17021-1 only requires the certification body to ask for your cause analysis and corrective actions within a defined time. The deadline is on your nonconformity report or audit report; if it is not, ask before you leave the closing meeting. As one published example, Schellman asks for a corrective action plan within 14 days, evidence of correction within 30 days and, for a major, evidence of remediation within 60 days. Your certification body's numbers may differ.
Will we lose our certificate?
Not automatically. At a surveillance audit, a major nonconformity has to be corrected and its corrective action accepted by your certification body. If a certified organization fails to meet certification requirements, ISO/IEC 17021-1 requires the certification body to suspend the certificate, which makes it temporarily invalid until the issue is resolved; the standard notes that suspension would not normally exceed six months, and an unresolved suspension leads to withdrawal or a reduced scope. At a recertification audit, majors must be closed before your current certificate expires, or it will not be extended. At an initial certification audit, no certificate is issued until majors are closed.
Can a major nonconformity be downgraded to a minor?
Sometimes, and the time to raise it is the closing meeting, with evidence. If the auditor missed a record or misread a procedure, show them. Grading is the auditor's judgment against the definition, so arguing that a finding feels harsh will not move it; showing that the required element exists and works can. If you still disagree afterwards, every accredited certification body is required to have an appeals process.
What is the difference between a correction and a corrective action?
A correction fixes the problem you found: the missed internal audit gets done, the bad parts get quarantined. A corrective action removes the cause so it does not happen again: someone owns the internal audit program and it runs on a schedule. Certification bodies ask for both, and a response that contains only the correction is the most common reason a major is not accepted, or comes back a year later.
Do several minor nonconformities add up to a major?
They can. Where several minor nonconformities relate to the same requirement or issue, an auditor can grade them together as a major, because the pattern shows the system is not working rather than that someone slipped once. Three missing calibration records is often a minor each; a calibration program that nobody is running is a major.
Related
- Nonconformity — the definition, and why your own procedures count.
- Corrective action — and how it differs from correction.
- Root cause analysis — getting past “human error.”
- Surveillance audit — what the certification body checks between recertifications.
Sources
- ISO/IEC 17021-1:2015, Section 9 (IAS training summary) — clauses 9.4.9, 9.4.10, 9.5.3.2, 9.6.3.2 and 9.6.5.
- European Accreditation, Question 39.1 — certification bodies' grading must match the ISO/IEC 17021-1 definitions.
- European Accreditation, Question 36.14 — the six-month limits at initial certification and after expiry.
- Schellman — what to do with an ISO nonconformity — one certification body's published response deadlines.
Changelog
- 2026-10-05 — Published. Built on ISO/IEC 17021-1:2015 (the requirements accredited certification bodies work to), European Accreditation's published interpretations, and the response deadlines one certification body publishes for its own clients.