Glossary · ISO and management systems
Missed requirements become nonconformities, and the fix has to reach the root cause.
A failure to meet a requirement, whether set by the standard, a law, a contract or the organisation's own policy, found in an audit or in daily work.
Back to the glossary01 · In plain words
In plain words
A failure to meet a requirement, whether set by the standard, a law, a contract or the organisation's own policy, found in an audit or in daily work.
If your policy says leavers lose access within a day and an auditor finds one who kept it for three weeks, that gap is a nonconformity. It does not mean the company is insecure. It means something you said you do was not done, and you now need to correct it and stop it happening again.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Nonconformities are the currency of management system audits. A certification body grades them, often as major or minor, and a major one can hold up a certificate until it is resolved. ISO 27001 expects you to react to each one, find the cause, take corrective action and check that the action worked, under clause 10.2. Buyers reviewing your certificate rarely see the list, but a pattern of repeat findings across audits tells a certification body the improvement loop is not turning.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The internal audit report
- Your own auditors raise nonconformities first; this is the cheap place to find them.
- The certification body's audit report
- Each finding is graded and you are given a deadline to respond with a plan.
- The corrective action log
- Where each nonconformity is tracked from finding to root cause to verified fix.
- Clause 10.2 of ISO 27001
- The requirement to correct, analyse and prevent recurrence, described in our own words here.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: offboarding at a diagnostics lab network
During an internal audit, the auditor samples ten leavers and finds two with live VPN accounts weeks after their last day. That is a nonconformity against the lab's own access policy. The quick correction is to disable both accounts. The root cause, found by asking why twice, is that HR's exit form never reached IT for contract staff. The corrective action routes every exit, staff or contractor, to an IT ticket automatically. Three months later the auditor re-samples and finds no gaps, and the item is closed.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Observation or opportunity for improvement
- An auditor's note that something could be better or may slip. No requirement is broken yet, so no formal corrective action is owed.
- Correction
- The immediate fix to the instance found. A corrective action goes further and removes the cause so it does not recur.
- Qualified opinion (SOC reports)
- A SOC auditor's modified opinion on a report. It belongs to attestation, not to ISO certification findings.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Log every finding with its source, requirement, owner and due date.
- Separate the correction from the corrective action in your records.
- Write the root cause in one sentence before choosing the fix.
- Re-check after a reasonable interval and record that the fix held.
- GuideNonconformity and corrective actionFrom a finding to a fix that holds, with root cause.
- GuideThe ISO 27001 internal auditWho may audit, what to test, and how to report.
Sources: ISO/IEC 27001:2022 clause 10.2 title (not quoted); ISO/IEC 17021-1 on how certification bodies handle audit findings, at summary level.
Questions about Nonconformity
What turns a minor nonconformity into a major one?
Scale and effect on the system.
Certification bodies commonly treat a finding as major when a requirement is missing altogether or the failure casts doubt on the system working at all, and minor when it is an isolated lapse. Exact grading follows the certification body's own rules, so read its definitions in your audit contract.
Can we argue with a nonconformity?
Yes, with evidence, at the time.
If you believe a finding is wrong, raise it in the closing meeting and show the evidence the auditor did not see. Once the report is final, the certification body's appeals process applies. Arguing without records rarely works.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.