12 Common ISO 9001 Nonconformities and How to Fix Them
Editorial note. UniCert is UAF-accredited for ISO 9001, ISO 14001 and ISO 45001, and is an IAF MLA signatory through that accreditation. Accreditation details are published at /accreditation.
An auditor checks the calibration status of measuring equipment against the quality records. Source: UniCert
Most ISO 9001 nonconformities land in three parts of the standard: Clause 7 (Support), Clause 8 (Operation) and Clause 9 (Performance evaluation). In the ISO 9001 audits UniCert teams carry out, the areas that generate the most findings in practice are the support and resource requirements in Clause 7, operational control in Clause 8 and performance evaluation in Clause 9. That concentration is a well-recognised pattern in quality management system auditing: it follows the ISO 9001:2015 clause structure [1], because Support, Operation and Performance evaluation carry the most day-to-day evidence an auditor samples. The recurring theme is how the system is run day to day, not the paperwork itself. If certification is new to you, read this alongside our guide to integrated management system certification.
One honest note before the list. Nonconformities are normal and expected, and a first certification audit that closes with zero findings is unusual. In the audits I lead, most first certification audits close with a small number of minor nonconformities rather than none. Minor findings on their own rarely put certification at risk, and whether you can fail an ISO audit explains what actually does. The question an auditor is really asking is whether you find and fix problems yourself, not whether any exist.
In the ISO 9001 audits UniCert teams carry out, findings concentrate in Clauses 7 to 9, covering Support, Operation and Performance evaluation. Source: UniCert auditor experience.
1. Calibration and verification of monitoring and measuring equipment (Clause 7.1.5)
Where you use equipment to prove that a product or service meets requirements, Clause 7.1.5 expects that equipment to be calibrated or verified against traceable measurement standards, at defined intervals, and identified so its status is clear [1]. Auditors raise it when calibration dates have lapsed, when certificates show no traceability to national or international measurement standards, or when gauges are in use with no label or record. In practice this is among the findings auditors raise most often. What keeps it away is a live calibration register, recall alerts before due dates, certificates that show traceability, and a defined response for when equipment is found out of tolerance. It is usually minor if isolated, and major if calibration is absent across the board or product has been released on the back of unverified measurement. This item bites hardest in production environments, so see also ISO 9001 in a manufacturing setting.
2. Control of documented information (Clause 7.5)
Procedures, forms and external documents need to be current, approved, version controlled and available where the work actually happens. Auditors raise this clause when superseded procedures are still in use on the shop floor, when there is no revision history, or when uncontrolled photocopies and references to obsolete forms are circulating. What keeps the finding away is a document register that shows owner, revision and approval date, a single controlled source for each document, and clear marking or removal of obsolete versions. It is normally a minor nonconformity, unless document control has broken down across the system.
3. Missing or incomplete records (Clauses 7.5 and 8.1)
Clauses 7.5 and 8.1 expect you to keep evidence that key activities actually happened, such as inspections, reviews, approvals and product release [1]. The finding appears when work has clearly been done but there is no proof of it: sign-off boxes left blank, inspection records with gaps, and no evidence that a required check took place. What good looks like is records completed at the time of the activity, legible, attributable to a named person, and retained for the defined period. It is a minor nonconformity when records are simply patchy, and a major when an entire control point has no records at all.
4. Weak root-cause analysis (Clause 10.2)
When something goes wrong, Clause 10.2 expects you to work out why it happened, not just what happened [1]. The finding appears when corrective actions treat symptoms, with "operator retrained" or "record now completed" written up and no analysis of why the system allowed the problem in the first place. Shallow root-cause analysis is one of the findings auditors raise most often. What resolves it is a structured method such as 5 Whys or a cause-and-effect diagram, actions aimed at the system rather than the individual, and a check for the same weakness elsewhere. It is usually a minor nonconformity, unless a pattern of ineffective actions shows the process does not work.
5. Corrective actions not closed out or verified (Clause 10.2)
Clause 10.2 expects you to complete your corrective actions and then confirm they were effective [1]. Auditors raise it when actions are left open well past their due date, closed with no evidence attached, or closed with no effectiveness check. What good looks like is a nonconformity log with named owners and dates, evidence attached at closure, and an effectiveness review weeks or months later. It is usually minor, and it becomes major when the corrective action process as a whole has stalled.
6. Competence and training records (Clause 7.2)
Decide what competence each role needs, make sure people have it, and keep the evidence. The finding usually appears when training matrices are out of date, when new starters have no records, when certificates have expired, or when there is no visible link between a task and the competence needed to do it. Good practice is a role-based competence matrix backed by induction records, refresher tracking and evidence of how competence was judged. In almost all cases this is a minor nonconformity.
7. Control of externally provided processes, products and services (Clause 8.4)
The requirement in plain English. Evaluate suppliers and subcontractors before use, apply controls based on risk, and re-evaluate them over time.
Why it gets raised. An approved supplier list with no evaluation criteria, no re-evaluation, no performance monitoring, and key subcontractors missing from the process entirely.
What good looks like. Defined selection criteria, recorded approval, ongoing monitoring of delivery and quality, and a periodic review that can remove a supplier.
Minor or major. Minor, unless an uncontrolled supplier has caused nonconforming output.
8. Customer feedback and complaints (Clauses 9.1.2 and 8.2.1)
Clause 9.1.2 asks you to monitor how customers see you, and Clause 8.2.1 expects complaints and feedback to be handled in a defined way. This gets raised when complaints are dealt with informally and left unrecorded, when nobody analyses trends, and when there is no measure of customer satisfaction. A single log for complaints and feedback, trend analysis that feeds management review, and a defined response process with timescales together resolve it. Findings here are almost always minor.
9. Management review (Clause 9.3)
Top management reviews the system at planned intervals against a defined set of inputs and produces defined outputs [1]. Auditors raise this clause when reviews miss required inputs such as audit results, supplier performance or the status of risks and opportunities, or when reviews produce no recorded outputs and actions. These are areas UniCert audit teams see repeatedly. What good looks like is an agenda that mirrors the Clause 9.3.2 inputs, decisions and actions recorded with owners, and evidence that those actions were followed up. It is a minor nonconformity if inputs are incomplete, and a major if management reviews are not happening at all.
10. Internal audit programme (Clause 9.2)
The requirement in plain English. Run a planned programme of internal audits that covers the whole system over time and reflects risk and past results.
Why it gets raised. Audits skipped, a programme that is not risk based, the same light-touch checklist every year, and auditors reviewing their own work.
What good looks like. An annual plan weighted towards higher-risk and problem areas, competent and independent auditors working to the principles in ISO 19011 [3], and findings that feed the corrective action process. Catching issues before the external visit is the whole point of an ISO 9001 internal audit checklist, and it is worth reading with the ISO 19011 auditing guidelines explained.
Minor or major. Minor if partial. Major if no internal audits have been carried out.
11. Monitoring, measurement, analysis and evaluation (Clause 9.1.1)
The requirement in plain English. Decide what to measure, measure it, and analyse the results to judge performance and the effectiveness of the system.
Why it gets raised. Data collected but never analysed, quality objectives with no metrics behind them, and no evidence that the numbers drive decisions. Clause 9.1.1 is one of the clauses that attracts the most findings.
What good looks like. A short set of meaningful indicators, regular review of trends rather than single data points, and documented decisions based on the analysis.
Minor or major. Minor.
12. Control of production and service provision (Clause 8.5)
The requirement in plain English. Carry out work under controlled conditions: the right instructions, released materials, suitable equipment, defined acceptance criteria, and identification and traceability where they are needed.
Why it gets raised. Work instructions not followed or not available at the workstation, process parameters not recorded, and product that cannot be identified by its inspection status. In the audits I lead, Clause 8 production and service provision is another of the areas where findings concentrate.
What good looks like. Current work instructions available where the work is done, in-process checks recorded, clear identification of pass, fail and pending, and traceability that matches customer and legal need.
Minor or major. Minor in most cases. Major where uncontrolled work has produced nonconforming output that reached the customer.
If you run an integrated system, expect these same weaknesses to surface against ISO 14001 and ISO 45001 as well. Document control, competence records, internal audit and management review are shared clauses across all three standards, so a gap in one usually appears in the others. That is one reason auditing several standards in one visit tends to expose systemic issues quickly.
Major vs minor nonconformities
Accredited certification bodies work to the definitions set out in ISO/IEC 17021-1 [2]. The table below sets out how the two grades differ in practice.
| Aspect | Minor nonconformity | Major nonconformity |
|---|---|---|
| Definition | An isolated lapse that does not undermine the capability of your management system [2]. | The absence or total breakdown of a required process, several minor findings raised against the same requirement, or anything that casts significant doubt on your ability to deliver conforming product or service [2]. |
| Typical timescale to close | Corrective action plan submitted within a few weeks, with the evidence checked at the next visit. | Cleared on a tighter schedule, with objective evidence, before the certificate is issued or maintained. |
| Example | One missing training record or a single overdue calibration. | No calibration system across the site, or management reviews that are not taking place at all. |
| Effect on the certificate decision | Certification can proceed once the corrective action plan is accepted. | Certificate withheld at Stage 2, or put at risk at surveillance, and a follow-up audit may be required at your cost. |
How to stop them recurring
Recurring findings almost always trace back to a corrective action process that fixes the instance and not the cause. The steps below keep that from happening, and they pair well with preparing thoroughly for the ISO 9001 audit.
- Contain first. Correct the immediate problem so it stops causing harm.
- Find the real cause. Use a simple structured method and keep asking why until you reach something in the system: a missing control, an unclear responsibility, or a process that was never defined.
- Check how far it spreads. If one site or line has the gap, the others probably do too.
- Change the system, not just the person. Update the procedure, the check, the training plan or the form, then tell the people affected.
- Verify effectiveness later. Come back weeks or months on and confirm the finding has not returned.
- Feed it into internal audit. Add the weak area to your next internal audit scope so a relapse is caught in-house rather than by the external team.
FAQ
How many nonconformities is normal in an ISO 9001 audit?
A small number of minor nonconformities at Stage 2 is typical, and a first audit that closes with none is unusual. The auditor is judging whether you find and fix issues yourself, not whether any exist.
Will a nonconformity stop me getting certified?
A minor nonconformity will not, provided you submit an acceptable corrective action plan within the timescale your certification body sets. A major nonconformity has to be cleared with objective evidence before the certificate is issued, and it can trigger a follow-up visit [2].
What is the most common ISO 9001 finding?
One of the findings UniCert audit teams raise most often is incomplete or lapsed calibration and verification records for monitoring and measuring equipment under Clause 7.1.5, including records that lack traceability to measurement standards.
How long do I have to close a nonconformity?
Your certification body sets the timescale. A corrective action plan is usually due within a few weeks, with evidence of completion in a defined window after that. Majors run on a tighter schedule than minors [2].
Which ISO 9001 clauses get the most findings?
Clauses 7, 8 and 9, which cover Support, Operation and Performance evaluation. In the ISO 9001 audits UniCert auditors lead, the support and resource requirements, operational control and performance evaluation are the areas that generate the most findings.
Turning predictable findings into a stronger system
Most ISO 9001 nonconformities are predictable. They cluster in a few clauses, they repeat across organisations, and they are usually about everyday practice rather than missing documents. Work through the twelve items above, check each one honestly against your own system, and route anything you find through a corrective action process that reaches the root cause. The clause numbers may shift a little with the next revision of ISO 9001, yet the pattern of findings rarely moves. For how ISO 9001 sits alongside ISO 14001 and ISO 45001 in a single system, see our guide to integrated management system certification.
References
- ISO 9001:2015, Quality management systems, Requirements. International Organization for Standardization, iso.org. Clause structure for Support (Clause 7), Operation (Clause 8) and Performance evaluation (Clause 9). Tier-1 primary standard.
- ISO/IEC 17021-1:2015, Conformity assessment, Requirements for bodies providing audit and certification of management systems, Part 1: Requirements. International Organization for Standardization. Basis for the treatment of minor and major nonconformity in accredited certification. Tier-1 primary standard.
- ISO 19011:2018, Guidelines for auditing management systems. International Organization for Standardization. Principles for competent, independent internal auditing. Tier-1 primary standard.
Practical summary of the key steps covered in this guide. Source: UniCert