Handling Non-conformances From an ISO Audit: Major vs. Minor NCR Timelines

Receiving a non-conformance report after an ISO audit can feel like a setback for any business.

Understanding response timelines and evidence requirements for major versus minor findings ensures you protect certification and improve your management system.

Defining Major vs Minor Non-Conformances

Auditors distinguish findings by the risk they pose to the integrity of the management system.

A major non-conformance suggests a breakdown of a required process or a significant risk to product or worker safety.

A minor non-conformance is usually an isolated lapse or a single procedural omission.

It shows the system is generally working but a specific area needs adjustment to remain compliant.

Response Timelines for Major Findings

Timelines for major findings are typically strict and treated as high priority by certification bodies.

Organisations are commonly expected to provide an initial corrective action plan rapidly, often within about 48 to 72 hours of the audit closing.

Auditors usually expect evidence that the issue has been contained immediately.

The full resolution or documented downgrading of a major finding is often expected within a matter of weeks to a few months.

Failure to address a major finding in the expected window can result in suspension or withdrawal of certification.

Managing Minor Non-Conformance Resolution

Minor non-conformances follow a more relaxed schedule compared with majors.

Many organisations aim to close minors before the next surveillance audit or within six months to prevent accumulation.

Minor issues can escalate to major findings if ignored or if they indicate systemic failure on re-evaluation.

Effective ISO non-conformance management uses a non-conformance register to track ownership and deadlines.

You can document actions using templates, such as a Free Change Management Form, to maintain an audit trail.

Building a Robust Evidence Pack

Auditors will not accept unsubstantiated claims that an issue is fixed.

An evidence pack must prove the change is embedded in daily operations.

For a major non-conformance action plan, start with a Root Cause Analysis (RCA).

An RCA explains why the failure happened rather than only what happened.

Your pack should include clear before-and-after artefacts such as revised procedures, signed training records, and updated risk assessments.

If the finding related to physical safety, include a Site Safety Audit report showing the corrected environment.

Photographs, dated logs and verification checklists strengthen the pack.

The ISO Audit NCR Process Steps

The ISO audit NCR process follows a clear path from the closing meeting to final sign-off.

Once the auditor issues the report, formally acknowledge the findings and record them in your non-conformance register.

Assign an internal owner to each finding to ensure accountability and timely action.

Begin by assessing whether the finding is a symptom of a larger problem using tools like the 5 Whys.

Develop a corrective action plan that defines containment, corrective action, verification and target dates.

Common Mistakes in Corrective Action

Many organisations treat only the symptom rather than the root cause.

For instance, telling a worker to 'be more careful' after a missing signature is not adequate.

A meaningful correction might be moving to a digital form with mandatory fields to prevent recurrence.

Auditors expect systemic changes that make the error less likely to recur.

Another common mistake is submitting an ISO audit non-conformance response without fully checking the evidence for completeness and signatures.

Professional Support for Audits

Navigating a difficult audit is easier with experienced professional advice when needed.

An experienced WHS consultant in Australia can help interpret auditor comments and assemble an evidence pack.

This is especially valuable for complex standards such as ISO 45001 or ISO 9001.

Professional guidance helps align responses with certification body expectations and reduces the risk of recurring findings.

Verifying the Effectiveness of Actions

The final step is verification after corrective actions have been in place for a defined period.

Conduct internal checks to confirm the new process is working and the issue has not recurred.

Document verification activities in your management system to show auditors you monitor effectiveness.

Use a WHS audit template to structure these internal checks and record outcomes consistently.

Common Questions (PAA)

How fast should I respond to a major non-conformance?

Provide an initial corrective action plan rapidly, commonly within 48 to 72 hours, and show immediate containment.

What should an evidence pack for a major NCR include?

Include a Root Cause Analysis, containment records, revised procedures, training evidence, dated photos and verification logs.

Can minor non-conformances wait until the next surveillance audit?

Often yes, but organisations should aim to close minors within months to avoid escalation or accumulation.

Who decides if a finding is major or minor?

The auditor determines the classification based on risk to the management system and conformity requirements.

For more detailed templates and examples, use the links within this article.

Need a hand?

Spire Safety carries out independent WHS audits across Australia, giving you a clear picture of where your system stands and what to fix first. Get in touch to talk it through.