Findings, corrective action, and what auditors actually sample
Lesson 4 of 5 in Certification, Audit, and Integrated Management Systems: ISO/IEC 42006.
Every audit conversation eventually compresses into three words: major, minor, or observation. Knowing the taxonomy — and how auditors apply it — changes how you prepare and how you respond in the room.
A major nonconformity is a failure that undermines the management system’s ability to achieve its intended results: a required process absent or systemically broken (no impact assessments performed anywhere, despite clause 6.1.4), a total breakdown of a control claimed in the SoA, or an accumulation of related minors revealing systemic collapse. Majors block certification until corrected and verified — sometimes by a follow-up visit.
A minor nonconformity is an isolated lapse in an otherwise functioning requirement: the process exists and generally works, but this supplier assessment is missing, that risk-register entry was not updated after a significant change. Minors do not block certification, but they demand a corrective action plan the CB accepts — and they are re-examined at the next surveillance, where an unresolved minor matures into a major.
An observation (or opportunity for improvement) is not a nonconformity at all: the requirement is met, but the auditor sees fragility or a better practice. Observations carry no obligation — and smart teams treat them as free consulting from someone who audits fifty organisations a year.
Classify the audit finding
Interactive decision tree — outcomes:
- Major nonconformity
A failure that undermines the AIMS’s ability to achieve its intended results. Certification (or continued certification) is blocked until root cause is addressed and correction verified — the CB may require a follow-up audit. Typical clock: around 90 days.
- Minor nonconformity
An isolated failure in an otherwise functioning requirement. Certification can proceed with an accepted corrective action plan; effectiveness is checked at the next surveillance. Left unresolved, it escalates.
- Observation / opportunity for improvement
No requirement is breached. The auditor is flagging fragility or sharing better practice. No obligation attaches — but recurring ignored observations have a way of returning as nonconformities when the fragility finally breaks.
When a nonconformity lands, the response that satisfies clause 10 (and the CB) has four distinct parts, and auditors check all four: correction (fix the instance), root-cause analysis (why did the system let this happen?), corrective action (change the system so it cannot recur), and evidence of effectiveness (show, later, that it worked). The classic failed response fixes the instance and stops — the same finding then reappears at surveillance wearing a ‘major’ badge.
This is also where your internal audit programme (clause 9.2) earns its keep. External auditors consistently report the same pattern: organisations whose internal audits are rigorous — competent auditors, independent of the area audited, real findings, closed corrective actions — sail through Stage 2, because every embarrassing discovery has already been discovered internally. An internal audit that found ‘no nonconformities’ across a first-year AIMS does not reassure a certification auditor; it tells them the internal audit is decorative.
Interactive sorting exercise: A Stage 2 auditor samples evidence across the AIMS. Match each evidence request to the part of 42001 it tests.
Key terms: major nonconformity, minor nonconformity, corrective action, internal audit, root cause analysis
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.