The 5 top reasons for nonconformance at certification audits
By Alan M. Jones
Qudos Management Pty Ltd.
March 2025
A major NC (nonconformance) at a certification audit can present a serious problem for a business. If you know the most likely causes of them, you can better prepare to ensure that your organization doesn’t fall into the same traps, and gets a successful outcome.
I have conducted more audits than I care to remember over many years and across a wide range of industries. So, I have listed what I consider to be the most frequent reasons for nonconformance at certification audits.
Here are my top 5:
1 Document Control / Management
There are a variety of contributing elements here. The key ones seem to be: availability, duplicate versions in use, superseded documents in use, broken links / missing documents, and a failure to conduct document reviews. There's also another element of document control that may contribute more N/Cs over time. That is the ISO 27001 control requiring policies to be acknowledged by the relevant people. Many systems simply don’t have the means of enabling / recording that.
2 Internal audits
Nonconformances in this area can often relate to a failure to perform regular internal audits, a failure to maintain impartiality, significant gaps in the audit programme, or action not being promptly taken on issues raised.
3 Management Review
Typically, N/Cs are raised here due to one of these reasons:
- A failure to regularly perform management reviews
- The review does not meet the input requirements of the standard
- There are no outputs
ISO does not specify the format for a management review, but most organizations would conduct a meeting. ISO also uses the terms Inputs for what information is considered and Outputs for what are the results. In a meeting format, the inputs would be the agenda, and the outputs would be Actions. To avoid drift, we would recommend that Actions are clearly assigned to someone with a target date for them to be taken.
Find out about our Management System Business Partner service
Let our qualified and experienced consultants and software help keep your ISO management system compliant. For Quality, Information Security, OHS (Occupational Health & Safety), and Environmental management.
4 Improvement / Corrective Action
This can sometimes relate to issues raised at items 2 and 3 above. Findings at internal audits or outputs from a management review may not be addressed promptly / at all. For Quality systems, there may also be an element of not promptly / adequately logging and responding to customer complaints
5 Competence
Lack of evidence of the required level of training / competence of people performing work. It's not uncommon for organizations that employ people in roles where qualifications are required to be unable to produce evidence of them having those qualifications.
Some other contenders
I have based the above list on my own experience and with inputs from other professionals in the industry. Others may come up with a variation on the top 5 because of their individual experience. Here are some other contenders:
An AI response with Microsoft Copilot matched my top 5 except it had Risk management in place of Improvement / Nonconformance.
There were suggestions for Supplier management / evaluation (including from Michelle Coleman of Southpac).
Another suggestion was for Operational processes. Just another personal observation here. I believe those tend to occur more when something about an operation, job, or project is a little bit out of the ordinary. Where a valuable client has asked for something bespoke, when the operation is performed by someone who doesn't usually do it, or there is some other unusual circumstance.
I was also tempted to include Objectives. Many organizations have objectives that are quite vague. The SMART concept will keep Objectives on the straight and narrow and is very easy to apply. I won’t add any more here as it is covered in another one of our posts.
If you can eliminate the above as reasons for nonconformance, you will be well on the way to success at your next certification audit.
Qudos Club is all about helping you with your management system, Its free to join and you will get access to newsletters, resources and more.
Click the LinkedIn Follow button below to follow Qudos and be the first to receive ISO management system news and further articles like this.