Closing ISO nonconformities: majors, minors, and the calendar

This page is for operations, quality, IT, security, and compliance leads at mid-market manufacturers and professional-services firms who just received Stage 1 findings, Stage 2 findings, or a surveillance nonconformity. The useful question is a procurement question: what has to be true before the next date on the calendar can stay where you put it.

A nonconformity is not a comment in the closing meeting, and it is not a personality clash with the auditor. It is a written statement that a requirement was not met, tied to evidence. What happens next depends on the grade, on the visit that raised it, and on the rule your certification body (CB) wrote in the report. Those rules are not identical from body to body. This page will not invent a deadline, a fee, or a promise that the certificate follows the closing meeting. Confirm the live rule with the body that holds, or would hold, the file.

What the two initial visits actually sample is Stage 1 versus Stage 2. Where those dates sit between the RFQ and first surveillance is how long ISO certification takes. What the rest of the cycle samples, including why a surveillance major is not a softer closer, is surveillance and recertification. If you do not yet have a system worth auditing, start at first ISO certification. If you already hold a certificate and the temptation is to change bodies to escape the finding, that job is a transfer, and an open major does not make it faster.

1. A nonconformity is a failed requirement

Skip the clause lecture. Buyers need to know which sentences in the report can move a date.

A nonconformity says a requirement was not met. The requirement might be the standard, your own documented process, or a legal or customer obligation your system claims to control. The useful report names the requirement and the evidence: the gauge that was past due, the access review that did not run, the internal audit that never touched this system, the model that shipped with no approval record. If the paragraph does not name both, ask for that in writing before you draft a response. You cannot correct a sentence you cannot restate.

An observation, an opportunity for improvement (OFI), a comment, or a concern is the auditor noting something they are not grading as that failure. Bodies do not share one vocabulary. Some write "opportunity for improvement." Some write "observation." Some mention a concern only in the closing meeting and leave it out of the report. Some do not use these labels at all and will only record nonconformities. None of those habits is a secret grade you can decode from a homepage.

An observation does not, by itself, hold certificate issue. It also does not expire. The same gap, with no owner, is a common nonconformity at the next visit, because the auditor already told you where to look. If you would be embarrassed to see the sentence again, give it a name and a date. If you would not, say so and move on. Do not let a salesperson relabel a graded nonconformity as an "observation" so a customer date can stay on the slide.

Two arguments are legitimate. One is not.

Argue the evidence when it is wrong: the record exists, the process they sampled is outside the scope you agreed, the requirement they cited is not the one your system has to meet. Do that in writing, with the record attached, inside the response window. A closing-meeting debate that never reaches the file did not happen.

Do not spend the window arguing the adjective when the evidence is real. Calling a missing internal audit a minor does not make the audit exist. The person who decides on the certificate was not in the room for the argument. They read the report.

You can contain the problem and still dispute the grade. If nonconforming product, exposed data, or an unsafe condition is still moving, stop that first. A dispute is not containment. Ask the body what their written path is if you believe a requirement was misapplied. Do not invent an appeals process they have not described.

2. Major versus minor, in buyer language

Labels vary. Major and minor are common. Some bodies say Category 1 and Category 2, or use another pair. Read the definition in their procedure, which should travel with the report or the contract. The pair below is the split mid-market teams can use while they wait for that sentence. It is not a claim that every body draws the line in the same place.

A major is a systemic failure, or a required process that is absent, or a lapse serious enough that a competent reviewer would doubt the system can meet its own claims. Examples that show up in real plants and practices: internal audit or management review that never touched this system; a scope that still includes a warehouse the pack pretended was out; nonconforming product with no disposition; an information-security control you declared applicable and cannot show; an AI system in the certificate claim with no owner and no approval record. A typo in a procedure title is not this.

A minor is a lapse that does not, by itself, collapse the system. One overdue calibration in a programme that otherwise runs. One access review missed where the process exists and the other months are there. One record incomplete on a process people can still walk. The instance is real. The system around it is visible.

What the report is doing	What it usually means	What it usually does to the date
Major nonconformity, or the body's severe grade	The system failed in a way that raises doubt	Usually holds certificate issue. Often holds a Stage 2 date if Stage 1 found the process missing. At surveillance, can move the certificate toward suspension if it stays open past the body's date
Minor nonconformity	A real lapse inside a system that otherwise exists	Often travels on an accepted plan and a later check. Ask whether issue still waits. A stack of minors that describe one missing process is no longer "minor paperwork"
Stage 1 concern, or "not ready for Stage 2"	The design of the system will not support the implementation audit yet	Move Stage 2. Booking it anyway buys a visit that cannot finish
Observation, OFI, comment	Not graded as a failed requirement	Does not, by itself, hold issue. Put an owner on it if the next visit would be embarrassed

What usually blocks certificate issue or a Stage 2 booking. An open major. A Stage 1 finding that a required process does not exist, even when the body used the word "concern" instead of "major." A file the independent reviewer cannot verify. The auditor recommends. Someone who did not audit you decides. That person does not issue because the closing meeting felt friendly.

What usually does not block, by itself. A single minor with a plan and a due date the body has accepted, when their rule is to check effectiveness later. An observation. A positive comment. "Usually" is doing real work in that sentence. Some bodies want every nonconformity verified before the decision, minor or not. Ask. A quote or a report that will not say which rule applies has not described the programme.

Why "we'll fix it later" fails for a major. Later is a promise. The decision needs evidence the body said it will accept: the process changed, the instance was corrected, and someone can see that the change is in use. A sentence in a portal that says the action is "in progress" after the customer date is not verification. The customer, the portal, or the insurer stored a certificate number, or is waiting for one. They cannot store your intention.

The same failure shows up as a calendar, not as a moral lecture. Verification of a major is one of the waits you cannot compress by typing "urgent." Auditor time for a follow-up is the same scarce bench as the original visit. Shutdown weeks you already named still apply. If the gap between Stage 1 and Stage 2 runs past the interval the body will accept, they may repeat part of Stage 1. That limit belongs on the quote. It is spelled out on how long ISO certification takes.

A major you could have closed in internal audit is a readiness choice. The test for whether the system was real enough to invite a body is still first-certificate readiness. The auditor did not invent a missing management review.

Do not shop for a friendlier grade. If you already hold a certificate, an accepting body cannot issue a transfer while majors are open. It has to see them closed and accept your plan for whatever minors remain. The file travels with you.

3. How findings show up across the cycle

The grade words can look the same. The consequence depends on which visit wrote them.

Stage 1 is a design review of readiness: scope, documented information, internal audit, management review, and — where they are in scope — a Statement of Applicability or an AI management system that looks used. You should leave with written findings when Stage 2 would be premature. Some bodies grade those findings as nonconformities. Many write them as concerns or areas that must be cleared before Stage 2 is confirmed. Treat the effect as the fact. If the report says the system is not ready, the next gate is "fix the system," not "hold the date we already told sales." Confirming Stage 2 for the following week, while internal audit of this system does not exist, buys a visit that cannot finish. What that visit is for sits in Stage 1 versus Stage 2.

Stage 2 samples whether the system works. In a plant that is the floor, receiving, calibration, nonconforming product, the shift you claimed. In a professional-services firm it is how work is taken, staffed, reviewed, and delivered. For ISO/IEC 27001 it is the controls you said were applicable. For ISO/IEC 42001 it is how a system in scope was approved, monitored, or retired. Nonconformities here are the ones that sit between the closing meeting and the certification decision. The closing meeting ends the sample. It does not issue the certificate. Ask what must be closed before review starts, what window they state for a clean file, and what window they state for a minor and for a major. Those three answers are the distance between "the audit is over" and "the portal can store a certificate."

Surveillance samples whether the system still lives. The spine almost always includes the status of every open nonconformity from the last visit. A major here is not informal, and it does not wait politely for recertification. Unresolved, past the date the body set, it can suspend or withdraw the certificate. A plan for remaining minors is often acceptable. An ignored major is not. Recurrence at the next visit is worse than the original finding: it says the action did not work. "We closed it in the portal" is not the same as "the process changed." The cycle page is surveillance and recertification.

Recertification is a fuller look before expiry, with the same body, so a new cycle can start. Staff it more like Stage 2 than like a quiet surveillance. Open majors can block that new decision the same way they block an initial one. Recertification is not a transfer, and a transfer is not a way to skip the finding. If the certificate is expired, suspended, or a required visit was missed, you are a new client. That is Stage 1 and Stage 2 again.

The commercial shape of all four — days, stages, travel, what a follow-up costs in the proposal — belongs in what a quote should include. This page will not invent those day counts or a price.

4. What a competent response looks like

Management-system standards expect you to control nonconforming outputs and to deal with causes. They do not publish a mandatory response worksheet, and a downloaded file with an ISO logo in the header is not one. Use the certification body's portal or the form they sent with the report. If they did not send a form, a plain record is enough, provided it matches the evidence they said they will accept. Do not relabel your record as an ISO-mandated template.

A response the process owner can defend has five parts. Order matters less than whether each part is actually there.

Containment. Stop the instance from still doing harm. Quarantine the lot. Hold the shipment. Disable the account. Pause the release of a model that has no approval record. Tell the customer if your own process says you must. Containment is what you do this week. It is not the essay on why the process failed, and it is not optional while you dispute the grade.

Look past the single example they found. The other shift, the other site, the other engagement team, the other model in the same inventory. A finding at one plant on a multi-site certificate is a question about the rest of the programme, not a souvenir from one building. Where that map comes from is multi-site certification scope.

Cause. Name a process you own. "Human error," "training," and "the auditor was strict" are not causes. They are ways to end the paragraph. If the gauge was overdue because nobody owns the calibration list, the cause is the list and the owner. If the access review did not run because the calendar invite has no backup when that person is out, the cause is the calendar. If internal audit never touched this system, say that. Five questions in a row only help when the last answer is a process you can change.

Correction. Fix the instance they found. Calibrate the gauge or remove it from use. Run the missed review. Disposition the nonconforming lot. Put an approval record on the system that already shipped, or take it out of the claim. Correction without a process change leaves the next instance waiting.

Corrective action. Change the process so the class of problem is less likely to recur. Put the gauge on a list someone reviews. Add a second name to the access-review calendar. Make internal audit sample this system on a plan, not when a registrar is booked. Retraining the person the auditor interviewed is corrective action only when competence was the cause and you changed how competence is checked. Retraining the night shift that nobody sampled is how the same gap returns on days.

Effectiveness check. Say how you will know the action worked, when you will look, and what record you will keep. The next internal-audit sample that includes this process. A management-review note that records the result, not a standing agenda item that says "reviewed." Two uses of the gauge after it returned to the programme. The next three client files that show the missing review. The joiner-mover-leaver sample that includes the account they found. For an AI system, the inventory row that now names who may approve or retire it, plus one decision made under that rule.

"Closed in the portal" is an administrative status. It is not an effectiveness check. For a minor, the body may accept a plan and look at the check on the next visit. For a major, expect them to want the check, or to perform their own verification, before they recommend a decision. Ask which. Do not assume the minor rule covers the major.

The certification body can tell you what evidence it will accept. It should not draft the procedure it will verify next year. If you need someone to rebuild the process, hire that help separately. Who writes the system and who may certify it are different jobs. That split is consultant versus certification body.

5. Questions that keep the replies comparable

Ask these in writing. If you already have a body, ask them of the person who owns the file, and keep the answers with the report. If you are still choosing a body, ask the same four of every body on the shortlist, against the same scope pack, so the calendars you compare are calendars for the same rule.

1. What is the response deadline for this finding, and what happens if we miss it? The body sets the date. This page will not invent one. Majors move faster than minors. Missing the date is how a file that could have reached a decision becomes a suspension conversation, or how a Stage 2 date disappears. Put the date on the operations calendar the day the report arrives, next to the owner's name. A deadline that lands in inventory week or in the only week the management-system owner is out is a fact you raise immediately, with a date you can meet. It is not a reason to ignore the finding.

2. What evidence will you accept for this finding? A revised procedure is rarely enough on its own. They usually want a record that the procedure was used: the calibration certificate and the two jobs after it, the access review that ran, the disposition record, the approval on the model. Ask them to name the evidence for this finding. "Send whatever you have" produces a second round of questions and a later review.

3. Will you verify by a review of records, or do you require a follow-up visit? Records are enough when the evidence is a record and their procedure allows a desktop review. A follow-up visit is the honest tool when someone has to see the process run: a line that was not operating, a control that exists only on the floor, a shift that was not sampled. A video tour held by the quality manager is not that sample. The method split is the same one you should already have written for the main visits, in remote versus on-site ISO audits. Ask which method applies to this finding. Do not shop until a body agrees to a method their procedure does not allow.

4. How does that choice move the calendar? You want four dates, not a mood. When they will finish a record review after you submit. The earliest follow-up visit they can staff, and whether your blocked weeks still apply. Whether Stage 2 stays booked, moves, or waits on a repeat of part of Stage 1. Whether certificate issue, suspension, or the recertification decision waits on their verification. The clean-file decision window and the window with an open major are different numbers. Ask for both if you are still at the quote stage. Write them on the same skeleton as how long ISO certification takes.

If you are still awarding the work, add the questions the quote already owes you. Which legal entity would issue, and which accreditation covers this standard and this scope — you will check that live, the same way as verifying accreditation. What must be closed before they will book Stage 2 after Stage 1. What must be verified before the certification decision for a minor and for a major. Whether a major follow-up is on-site. A body that calls majors informal, or that offers to write the corrective action and then certify it, is describing a different product. Independence is a buying condition. It is not a slogan you add after the award.

What the rest of a comparable proposal contains — programme, sites, travel, the three-year cycle — is what CB quotes include. How to score the replies is compare a shortlist.

6. Keep the RFQ and the customer date honest

Two moments. Do not mix them.

The report is already in your hands. Update the date you told the customer, the portal, or the insurer before you update the slide. An open major means issue waits on verification. Say that. A follow-up visit means a week you can host and an auditor the body can staff. Say that too. Hiding the finding from the customer while you "see how the response goes" is how a real date becomes a missed date. Internally, one owner writes the response. Process owners supply the evidence. Management review hears the cause if the cause is systemic. The certification body receives one package, on their deadline, not a thread of partial promises.

You are still choosing a certification body. The finding does not exist yet, or you are moving a certificate you already hold. Either way, the outbound page stays one pack. Name the legal entity, the standard and edition, the sites, the owner, and the weeks you cannot host an audit or a follow-up. If you already know a gap a Stage 1 would write down — no internal audit of this system, a site you hope they will not ask about — close it or disclose it. Do not send a pack that describes a system the floor does not run and then act surprised by the grade.

If this is a transfer, the pack includes the status of every open nonconformity. Open majors are a reason to finish the response with the current body, not a reason to omit them. The accepting body will ask. The checklist for that page is how to build a registrar RFQ / scope pack.

Leave off the pack:

• A certificate date with no gate, no system, and no plan for what a major would do to it.
• A request that Stage 1 find nothing. Competent bodies do not sell that.
• A different story for the logo you already prefer, including a softer version of a gap.
• A fee, a day rate, or an accreditation number you made up.
• A template you are calling an ISO-required corrective-action form.

7. Close the finding, or send one pack

If a body already holds the file, the work is the response they asked for. Contain the instance. Name a cause you own. Correct it. Change the process. Say how you will know the change worked. Send the evidence they agreed to accept, on the date they set. Ask whether they will review records or come back, and put that answer on the operations calendar. Then tell the customer the date that matches the file, not the date that matched the closing meeting.

If you are still choosing who will audit you, do that on one page. Verify accreditation for the legal entity and the edition before you invite a body you cannot award. Shortlist bodies you could actually hire in the directory, and score them with compare a shortlist. Write the findings rule into one scope pack: what must be closed before Stage 2, what a major does to the decision, whether a follow-up visit is required, and the weeks you can host it.

When that page is true, send it once with the Get quotes button below, including to the logo you already like. Award the programme whose rule you can staff. A body that will not say what a major does to the calendar has not finished the quote.