How to Handle Non-Conformities Found During a Certification Audit

A certification audit is a milestone moment for any organization, but discovering non-conformities doesn't have to derail your plans. Auditors expect to find gaps, and how you respond matters far more than the findings themselves. Handled well, a non-conformity becomes an opportunity to strengthen your management system rather than a setback to fear.

Understanding What a Non-Conformity Actually Means

Before reacting, it helps to understand the terminology. Certification bodies typically distinguish between two levels of findings: major non-conformities, which indicate a total breakdown of a requirement or a systemic failure, and minor non-conformities, which are isolated lapses that don't undermine the system as a whole. There may also be observations or opportunities for improvement, which are not formal non-conformities at all but worth noting.

The classification matters because it determines your response timeline. Major non-conformities usually require documented corrective action before the certificate can be issued or maintained, while minor ones can often be addressed within an agreed timeframe, sometimes verified at the next surveillance visit.

Stay Calm and Engage During the Audit Itself

The worst response to a finding is defensiveness or denial. Auditors are not adversaries; they are assessing evidence against a standard. When a non-conformity is raised, your goal is to understand it fully before the auditor leaves the room.

Take these steps on the spot:

• Ask the auditor to explain exactly which requirement of the standard has not been met.
• Request clarification on the objective evidence they observed, so there is no ambiguity later.
• Take notes and, if possible, review the written finding before the closing meeting to confirm accuracy.
• Avoid arguing about the classification unless you have a strong, evidence-based reason; a polite challenge with facts is acceptable, but emotional pushback rarely helps.
• Confirm the expected response deadline and the format the certification body requires.

Responding Within the Required Timeframe

Most certification bodies give you a defined window, often measured in weeks or months depending on the severity, to submit a corrective action plan. Rushing a response to meet the deadline is a common mistake. A vague promise to "retrain staff" or "update the procedure" will likely be rejected or questioned.

A credible corrective action response generally addresses:

• Containment: What immediate action stopped the problem from continuing or spreading?
• Root cause analysis: Why did it happen? Tools like the 5 Whys or fishbone diagrams help you go beyond blaming an individual.
• Correction versus corrective action: Fixing the specific instance is not the same as eliminating the cause. Your plan should show both.
• Evidence: What records, revised documents, training logs, or photographs will demonstrate the action was taken?
• Verification: How will you confirm the action was effective over time, not just completed once?

Turning the Finding into Lasting Improvement

Learn from Patterns, Not Just Individual Findings

One non-conformity is information; several related ones are a signal. If minor findings cluster around document control or competency records across multiple audits, that points to a systemic weakness worth addressing proactively. Share audit results with process owners, not just top management, and integrate the lessons into your internal audit program and management review. Organizations that treat every external audit as free consultancy consistently mature faster than those that treat it as an exam.

It is also wise to conduct your own gap analysis in the areas where you were found non-conformant. Sometimes an auditor samples only a handful of records; the same weakness may exist elsewhere. Checking and correcting those areas before the follow-up verification shows genuine commitment and builds auditor confidence.

Building a Culture That Handles Findings Well

Ultimately, the smoothest certification journeys belong to organizations where non-conformities are reported internally without fear. Encourage staff to raise issues through your own complaint, corrective action, or improvement processes long before the auditor arrives. When your internal audit program regularly surfaces and closes findings, external audit results tend to shrink to routine minor observations.

Keep a simple discipline: respond to every finding with the same structured approach, verify effectiveness honestly, and update your risk register where relevant. Certification is not a one-time trophy but a snapshot of a living system. Organizations that respond to non-conformities with curiosity, rigor, and follow-through not only keep their certificates; they build management systems that genuinely deliver the value the standards were designed to protect.

Related reading

• Your Step-by-Step Checklist for Preparing Your Documentation Before an Audit
• ISO 9001 vs ISO 14001: Which Standard Should Your Business Implement First?
• Avoiding the Pitfalls: Common Mistakes Businesses Make When Seeking First-Time Certification
• Getting ISO 9001 Ready: A Practical Guide to Preparing Your Company for the Certification Audit
• A Beginner's Guide to Understanding Management System Certifications