What is a nonconformance?
A nonconformance is a documented failure to meet a requirement. A minor closes through a corrective action plan; a major triggers a registrar follow-up and can put the certificate at risk.
If you have just received a major and want to know what happens next, start with We got a major nonconformance. Are we going to lose our certification?
What it is
The word covers two related things, and conversations go wrong when people mix them.
A product nonconformance is a part or a batch that does not meet its requirement. Clause 8.7 governs it: you identify it, control it so it cannot be used by mistake, decide what to do with it (rework, repair, scrap, concession, return), and keep a record of the decision and who made it.
A system nonconformity is a finding written by an auditor against a clause. It says your system failed to meet a requirement, names the evidence, and requires a response.
System findings come in two grades. A minor is an isolated lapse that does not break the system. A major is a total absence of a required process, a systemic breakdown, or something that puts product conformity at risk. Averages across audits put minors at roughly four to six per visit, which is normal rather than alarming.
When you will hear it
On the floor, about parts. On the audit report, about the system.
In a customer audit, where a finding against your process is often written in the customer's own format rather than the standard's, but behaves the same way.
Attached to a deadline. A major has to close within the registrar's window, usually 60 to 90 days from the audit.
What the auditor expects to see
For product: containment first. Identified, segregated or otherwise controlled, with a disposition record naming the authority who decided. Concessions accepted by the customer, where the customer's approval is required.
For system findings: root cause, not a restatement of the symptom. A response that says "the operator was retrained" answers who, not why. The auditor is looking for correction (fix this instance), cause analysis (why it happened), corrective action (stop it recurring), and verification (evidence it worked).
Repeat findings are treated harshly, because a repeat is evidence the previous corrective action was not effective.
Common mistakes
Grading your own findings down. Whether a finding is minor or major is the auditor's call. Arguing the grade is rarely productive; arguing the evidence sometimes is.
Closing on the deadline with a procedure change. Rewriting the procedure is correction. If nothing about how work happens changed, it will come back.
No containment on product. The most expensive nonconformance is the one that shipped because nothing physically stopped it.
Not raising your own. A company whose internal audits and floor process never record a nonconformance is not a clean company, it is a company that is not looking.
FAQ
How many nonconformities are normal at an audit?
Around four to six minors is a common outcome and does not threaten certification. Zero findings is unusual enough that experienced quality managers treat it with suspicion.
What is the difference between a nonconformity and an observation?
An observation, sometimes called an opportunity for improvement, carries no requirement to respond. It is the auditor flagging something that could become a finding. Many companies work them anyway, because they usually do.
Can we appeal a finding?
Yes. Registrars have an appeals process, and the ground that works is factual: the evidence was misread or the clause was misapplied. Disagreeing with the severity alone rarely succeeds.
Who decides the disposition of nonconforming product?
Whoever your procedure authorizes, and the record has to show it was them. Where the customer's approval is required for a concession, that approval has to be on file before shipment.
Tell us which audit is on your calendar.
A gap assessment is a flat-fee, on-site project led by a certified ISO 9001 lead auditor. Three founding-client spots are open for the quality practice.
We prepare you for certification. We never issue it. Your registrar's independence is the point.