Major vs minor nonconformity, and OFIs

Every certification audit ends with a list of findings and a grade on each one, and the grade matters more than the count. Ten minor nonconformities usually mean a corrective action plan; one major can delay certification or put an existing certificate at risk. Knowing how the grades are applied lets you challenge a grade with confidence when it is wrong, and lets you grade your own internal audit findings consistently.

Where the grades come from

ISO 9001 and the other management system standards do not grade nonconformities. They simply define a nonconformity as the non-fulfilment of a requirement. The major and minor split comes from the rules for certification bodies: ISO/IEC 17021-1 describes the two categories, and individual certification bodies build their own procedures and examples around them.

In paraphrase, the two categories are usually understood as:

• Major: a nonconformity that affects the capability of the management system to achieve its intended results.
• Minor: a nonconformity that does not affect that capability.

That is a short definition, and the space between the two is where judgement comes in. Most certification bodies add guidance along the lines described below, but the wording differs, so read your certification body’s own definitions. They are usually in the audit report template or the certification agreement.

How major nonconformities are usually judged

A major nonconformity is typically raised when one of these is true:

• A required process is missing. No internal audits have been carried out, no management review has happened, or there is no process for controlling nonconforming output.
• A process has broken down completely. The calibration system exists on paper, but most sampled equipment is overdue and nobody is managing it.
• There is significant doubt about control of product or service. Nonconforming product is reaching customers because inspection is not happening, or a legal requirement for safety is not being met.
• A number of minors point to the same failure. Several lapses in the same process, each minor on its own, show that the process is not working.
• A previous minor has not been addressed. Some certification bodies escalate a minor that is found again at the next audit with no effective corrective action.

The common thread is systemic failure: the auditor cannot be confident the system is delivering what it should in that area.

How minor nonconformities are usually judged

A minor nonconformity is a genuine failure to meet a requirement, but an isolated one, where the process as a whole still works. Typical examples:

• One training record missing out of twenty sampled.
• A procedure that refers to a superseded form.
• One supplier evaluation overdue by a few weeks while the rest are current.
• A management review record that covers all inputs except one.

The test auditors often apply is whether the lapse is a one-off within a working system, or evidence that the system is not working. The same missing record can be a minor in one context and part of a major in another.

Observations and OFIs

Below the nonconformities sit two softer categories. Names vary: some certification bodies use one, some both.

• Observation: no requirement is breached yet, but the auditor sees a risk that it will be. For example, the only person who knows how to run the calibration software is retiring next month, with no handover planned.
• Opportunity for improvement (OFI): the requirement is met, but there is a better way. For example, complaints are handled correctly but trend analysis is done by hand once a year and could be done monthly.

Neither usually requires a formal response. They are worth taking seriously anyway, because auditors typically look at them again next time, and an ignored observation is a common source of next year’s minor.

What each grade triggers

The consequences differ by audit type and certification body, but this table shows the usual pattern.

Grade	Typical response required	Typical timescale	Effect on certification
Major	Correction, root cause, corrective action, with evidence submitted for review; sometimes a follow-up visit	Commonly up to about 90 days	At stage 2, certification is usually not recommended until closed. At surveillance, an unresolved major can lead to suspension
Minor	Correction and corrective action plan accepted by the auditor; implementation checked at the next audit	Plan usually within a few weeks	Certification can usually proceed once the plan is accepted
Observation	None required; consider and record	Not applicable	None
OFI	None required; consider and record	Not applicable	None

For a major, the certification body usually wants to see more than a fix. It wants the cause, the corrective action taken across the system and evidence that it has been implemented. Sometimes this can be reviewed remotely from documents; sometimes the auditor comes back on site.

Worked examples from one audit

The following findings were raised at a surveillance audit at Kestrel Metals, a fictional fabrication business. They show how similar-looking issues can be graded differently.

1. No internal audits of the welding process in 18 months, against a programme that said twice a year, with no recorded reason. Graded major: the internal audit process was not being implemented for a high-risk process.
2. One supplier evaluation overdue by six weeks; the other ten were current and the review was booked. Graded minor: an isolated lapse within a working process.
3. Approved supplier list not reviewed since March 2024, with three of eleven suppliers lacking a current evaluation (FND-0142). Graded minor at this audit, with the auditor noting that a repeat would be considered for escalation.
4. Management review minutes did not record a decision on resources, although resources had been discussed. Graded minor.
5. Spreadsheet-based remediation log has no owner while the quality manager, R. Patel, is on leave. Recorded as an observation.
6. Line 1 and line 2 use different first-off inspection forms for the same product. Recorded as an OFI.

Why was the first finding a major and the second only a minor, when both concern a planned activity not happening on time? The difference is extent and impact. A six-week slip on one supplier, with a booked review and a working process around it, says little about the system. Eighteen months without an audit of the highest-risk process says the internal audit process is not controlling the programme it set itself. The same reasoning applies across standards: under ISO/IEC 27001, one leaver with an account left open for a week is likely to be minor, while no leaver process at all, or a pattern across most leavers sampled, is likely to be major.

Note, too, that findings 3 and 5 are linked. A repeat of the supplier list finding next year, combined with a remediation process that depends on one person, is exactly the pattern that can turn several minors into a major.

If you think a grade is wrong, raise it at the closing meeting with the evidence. Auditors usually explain their reasoning, and most certification bodies have an appeals process for the rare case where you cannot agree.

Grading your own internal audits

Internal audits do not have to copy the certification body’s scheme, but they do need a scheme, written down and applied consistently. Two approaches are common:

• Mirror the certification body. Use major, minor and observation, with the same definitions. This makes it easy to compare internal and external results and to predict how an issue would be graded externally.
• Use a severity scale. Grade by impact and urgency, for example low, medium, high and critical, and map those to response times and approval levels. This gives more resolution, which helps when prioritising actions.

A severity scale maps cleanly to the external grades if you define it that way. One mapping that many teams use:

Internal severity	Roughly equivalent to	Example response
Critical	Major, with immediate risk to product, people or legal compliance	Containment within 24 hours; action plan within a week
High	Major	Action plan within two weeks
Medium	Minor	Action plan within 30 days
Low	Minor, low impact, or observation	Consider at next process review

Findings in Orisynx are graded by severity as low, medium, high or critical, so you can apply a mapping like this and keep your own major and minor scheme alongside it.

Whatever scheme you choose, test it twice a year: give the auditors the same three or four sample findings and see whether they grade them the same way. Disagreement shows where the definitions need examples. For how to write the finding itself, see writing audit findings.