Nonconformity
A nonconformity is the failure to meet a requirement: something a standard, the law, a customer or your own procedure says should happen did not. Every ISO management system standard expects you to react to one, deal with its consequences and decide whether its cause needs corrective action.
- Clauses
- ISO 27001:2022 10.2 · ISO 9001:2015 10.2 · ISO 9001:2015 8.7 · ISO 13485:2016 8.3 · ISO 13485:2016 8.5.2 · ISO 42001:2023 10.2
Where the term appears
ISO 27001:2022 10.2, ISO 9001:2015 10.2 and ISO 42001:2023 10.2 set out the same response, from correction through to an effectiveness check. Quality standards add a second meaning for outputs: ISO 9001:2015 8.7 and ISO 13485:2016 8.3 cover nonconforming product, which you identify and hold back before deciding what happens to it. ISO 13485:2016 8.5.2 then treats the cause. The ISO 27001 improvement page walks through the response step by step.
Major and minor
The standards do not grade nonconformities; certification bodies do, under their own rules. A major usually means a requirement is not met at all or a process has broken down, and it normally has to be closed before a certificate is issued or kept. A minor is an isolated lapse in a system that otherwise works. An observation is not a nonconformity. An auditor writing either grade names the requirement breached and the evidence, so your record should too.
How Sted uses it
- Sted’s knowledge base includes a Corrective and Preventive Actions record template, under its Corrective and Preventive Action Procedure.
- Records are part of the Full Management System plan.
- Sted’s knowledge base includes a Nonconforming Output Record (REC-NCO), under the Production and Process Controls Procedure (PRC-PPC), for one output that came out wrong, from how it was found and held back to the disposition decided and who authorised it, with a cross-reference to any CAPA raised.
- Records are part of the Full Management System plan.
- Readiness counts four kinds of item per adopted standard (each linked document approved; its requirements for that standard adopted or excluded with a reason; at least one closed record per record template; each assigned person’s training completed), counts an item shared by two standards once overall, and reads 0% for a standard with nothing linked.
Sted does not grade findings. A certification body decides whether a nonconformity is major or minor.
Related terms
- Correction: the first response, which fixes the instance.
- Corrective action: the response that removes the cause.
- CAPA: the process that runs from a nonconformity to closure.
- Preventive action: the same thinking applied to a nonconformity that has not happened yet.
- Internal audit: where most nonconformities are found before a certification body finds them.
- Root-cause analysis for a CAPA: what to do once one is raised.