We got a major nonconformance. Are we going to lose our certification?

What to do now

A major is serious and it is survivable. What decides the outcome is the next sixty days, not the finding itself.

Read the finding precisely. A properly written nonconformity names the requirement, the objective evidence, and the gap. That is your specification. If any of the three is missing, ask your registrar to complete it before you respond, because you cannot fix what is not specified.

Confirm the dates in writing. When is the containment plan due, when is the full response due, when does the body expect verification, and will there be a follow-up audit. Registrars typically require a plan quickly and full closure inside 60 to 90 days of the audit. Do not rely on anyone's memory of these dates.

Contain first. If product conformity is implicated, contain before you investigate: identify what is affected, stop it moving, and work out where it already went. Containment is what protects your customer while the rest takes weeks.

Find the actual cause. A major usually means a required process was absent, systemically broken, or put product at risk. Retraining an operator does not answer any of those. The corrective action has to address why the system permitted it.

Ask the extent-of-condition question. Is the same gap on the other shift, the other line, the other site. Auditors ask it, and finding it yourself first is a much better position.

What it costs

Three costs, in rising order of size.

Your time. Root cause work, documentation, and verification across six to eight weeks, usually landing on the people who are already busiest.

The follow-up audit. A major generally triggers a registrar visit to verify closure before certification proceeds or continues. That is billed at your body's day rate, recently around $1,350 to $1,600 per auditor day plus travel, and it is the registrar's fee rather than anything a consultant's guarantee covers.

The escalation, if you miss the window. Unclosed majors lead to suspension and then to withdrawal. If more than six months pass at initial certification, a full new Stage 2 can be required, which means paying for the audit again. A suspended certificate is also reportable: defense supplier checklists commonly require prompt notification if your certification lapses, so the commercial cost can arrive before the audit cost does.

What good looks like

A response your registrar can verify without a second round of questions.

That means four things, separated clearly: correction (what you did about this instance), cause (why the system allowed it, with reasoning a reader can follow), corrective action (what changed so it cannot recur), and verification (what you examined afterward, on what date, to show the change worked).

It also means the response is proportionate. A major that says your internal audit program was absent is not closed by scheduling audits. It is closed by audits having happened, with findings raised and a management review that consumed them.

And it means you kept the customer informed where the finding touches their product. Discovering it through their own incoming inspection is far worse than hearing it from you.

When to bring in outside help

When the finding is about the audit program or management review. Those are the two majors that require the system to have run for a while, and someone who has closed them before knows what evidence the body accepts.

When you have had the same finding before. A repeat major means the previous closure was cosmetic, and repeats escalate. An outside reviewer will find the reason the last corrective action failed faster than the person who wrote it.

When the quality manager who owned the process has left. That combination is common and the clock does not pause for it.

You do not need help for a well-specified single-process major where the cause is obvious and the fix is in your control. Those close cleanly in-house.

How ARG does it

We work the finding as a root cause problem rather than a document exercise. That means starting on the floor with the process that produced it, not in the folder where the procedure lives.

The deliverable is a closure package your registrar can verify: correction, cause analysis with the evidence behind it, the corrective action with an owner and a date, the extent-of-condition check, and a verification plan that says what will be examined and when. Where the finding sits in an area we prepared, we run a mock audit against the closed action before the follow-up visit, so the verification is not the first test.

Noah Brown leads that work and has hosted registrar audits from the auditee side, including the uncomfortable ones. We prepare the response. Your registrar decides whether it closes, and that separation is exactly why their decision carries weight with your customer.

FAQ

How long do we have?

Typically 60 to 90 days from the audit for full closure, with a containment plan due much sooner. Your registrar sets the exact dates and they are in the audit report.

Will there be another audit?

For a major, usually yes. A follow-up audit verifies closure and is billed by your registrar. Minors are more often closed on documentary evidence reviewed remotely.

What is the difference between a major and a minor?

A minor is an isolated lapse in a system that otherwise works. A major is an absent process, a systemic breakdown, or something that puts product conformity at risk. The grading is the auditor's call.

Can we appeal?

Yes, through the body's appeals process. The argument that works is factual: the evidence was misread or the clause misapplied. Disagreeing with severity alone rarely succeeds.

Do we have to tell our customers?

Read your supplier agreements. Defense and aerospace flowdown commonly requires prompt notification of lost or suspended certification, and some customers require notice of majors affecting their product regardless.

Sources

• ISO 9001:2015 clauses 8.7 and 10.2; ISO/IEC 17021-1:2015 for certification body obligations.
• ARG market research 2026, section 4.2 for the 60-to-90-day window and the suspension path, section 7.6 for the 90-day and six-month rules and follow-up audit day costs, section 2.3 for supplier notification requirements.