ISO 27001 Audit Findings: Major vs Minor Nonconformity
A major nonconformity is a complete failure of an ISO 27001 requirement, and your certificate will not be issued or will be suspended until you close it. A minor nonconformity is an isolated lapse in something that otherwise works, and you can usually be certified while you fix it. Both require a documented corrective action with root cause analysis under clause 10.2. Certification bodies commonly allow around 30 days to submit a corrective action plan and about 90 days to provide evidence, though the exact deadlines are set by your certification body, not by the standard.
Getting a finding at your stage 2 audit is normal. Most Australian organisations collect a handful at first certification. What determines whether it becomes a problem is how you respond, and whether you understand which kind of finding you are actually holding.
What is a nonconformity in ISO 27001?
A nonconformity in ISO 27001 is a failure to meet a requirement. The requirement can come from the standard itself, from your own documented policies and procedures, or from a legal or contractual obligation you have committed to in your information security management system.
That second source catches people out. If your access review procedure says reviews happen quarterly and you did three last year, that is a nonconformity even though ISO 27001 never specifies a frequency. Auditors hold you to the rules you wrote for yourself.
An auditor records a nonconformity with three elements: the requirement that was not met, the objective evidence they observed, and the statement of nonconformity itself. If any of those three is missing or vague, you are entitled to ask for it to be clarified before you accept the finding.
What is the difference between a major and a minor nonconformity?
The difference between a major and a minor nonconformity is whether the information security management system can still be trusted to work. A major means a requirement has broken down entirely, or a group of minor issues shows a systemic failure. A minor means a single lapse in an otherwise functioning process.
| Major nonconformity | Minor nonconformity | Opportunity for improvement | |
|---|---|---|---|
| What it means | A requirement is absent or has failed systemically | An isolated lapse in a working process | A suggestion, nothing is broken |
| Effect on certification | Certificate withheld or suspended until closed | Certificate can usually be issued or maintained | No effect |
| Evidence needed to close | Corrective action verified, sometimes by a return visit | Corrective action plan, verified at the next audit or by document review | None required |
| Typical close-out | Plan in roughly 30 days, evidence in roughly 90 | Plan in roughly 30 days, evidence often at the next surveillance audit | Your discretion |
| Root cause analysis | Required and scrutinised | Required but proportionate | Not required |
| Example | No internal audit has ever been run | One of twelve monthly reviews was missed | Your risk register could be easier to filter |
The reclassification trap is worth knowing about. Several minor nonconformities pointing at the same underlying weakness can be grouped and raised as one major. Three separate minors about missing evidence in three different control areas may be written up as a systemic failure to maintain records. This is why fixing each minor in isolation, without asking what they have in common, tends to produce a worse result at the next audit.
What happens to your certificate if you get a major nonconformity?
If you receive a major nonconformity at a stage 2 certification audit, your certificate is not issued until the finding is closed. If you receive one at a surveillance or recertification audit while already certified, your certification body can suspend or withdraw the certificate if it is not closed within their stated timeframe.
In practice, at stage 2 this usually means the audit is completed, the report is written with a recommendation held pending, and you are given a window to respond. Once you submit evidence, the certification body either accepts it on review or schedules a short follow-up visit to verify it on site. The certificate is then issued, often backdated to the original audit date, though that is at the certification body’s discretion.
A suspension while already certified is more disruptive, because any customer checking your status during the suspension sees it. If a major is raised at surveillance, treat the response deadline as the real deadline, not a guideline.
Certification bodies operating in Australia are accredited by JAS-ANZ, and their timeframes and escalation rules come from their accreditation requirements rather than from ISO 27001 itself. Two certification bodies can therefore give you different windows for the same finding. If you are still choosing one, our guide to choosing an ISO 27001 certification body in Australia covers what to ask.
How do you write a corrective action that an auditor will accept?
A corrective action that an auditor will accept has five parts: containment of the immediate problem, a genuine root cause, the action that removes that cause, a target date with a named owner, and the evidence you will produce to prove it worked. Clause 10.2 of ISO 27001 requires you to evaluate whether similar nonconformities exist elsewhere, which is the part most teams skip.
Work through it in this order:
- Correction. Fix the immediate instance. If an access review was missed, run it now. This is not the corrective action, it is the first aid.
- Root cause. Ask why until you reach something you can actually change. “The reviewer was on leave” is not a root cause. “The review has no backup owner and no calendar reminder” is.
- Extent. Check whether the same weakness exists in other processes. If one review had no backup owner, check the others.
- Corrective action. The change that stops it recurring: a named deputy, an automated reminder, a revised procedure.
- Verification. The evidence that proves the fix held, such as the next two completed reviews with dates and reviewers.
Keep the analysis proportionate. A missed review in a 20-person business does not need a fishbone diagram, but it does need a stated cause that is not simply a person’s name. Blaming an individual is the fastest way to have a corrective action rejected, because people leave and the weakness stays.
Record all of this in a corrective action log. It is one of the records ISO 27001 expects you to retain, and your auditor will ask to see it at the next visit. Our guide to ISO 27001 mandatory documentation sets out what else belongs in that set.
What are the most common ISO 27001 nonconformities?
The most common ISO 27001 nonconformities in Australian organisations cluster around evidence rather than technology. Auditors rarely find that a control does not exist. They find that nobody can prove it ran.
- Internal audit not completed or not covering the whole ISMS. Running one internal audit that touches three controls does not satisfy clause 9.2. Our guide to the ISO 27001 internal audit covers the coverage expectation.
- Management review missing or undocumented. The meeting may have happened. Without minutes covering the clause 9.3 inputs, the auditor cannot verify it.
- Statement of Applicability out of step with the risk assessment. Controls marked applicable that no risk points to, or exclusions without a justification. See how to write a Statement of Applicability.
- Risk treatment plan never updated. Risks accepted in the original assessment with no evidence anyone has revisited them since.
- Supplier controls not applied. A supplier register that lists vendors but no evidence that any security assessment was performed.
- Access reviews performed inconsistently. The single most common minor, and the one most likely to be grouped into a major if it repeats.
Every one of those is cheaper to find yourself than to have an auditor find. That is the whole argument for a serious internal audit programme and, if you are approaching first certification, for an ISO 27001 gap analysis before the certification body arrives.
Common questions about ISO 27001 nonconformities
Can you still get ISO 27001 certified with a nonconformity?
Yes, with minor nonconformities. A certification body can normally issue the certificate once you have submitted an accepted corrective action plan, with the evidence verified at a later audit. With a major nonconformity you cannot be certified until it is closed and verified. The practical answer is that minors delay paperwork and majors delay the certificate itself.
What is the timeline to fix an ISO 27001 nonconformity?
Most certification bodies ask for a corrective action plan within about 30 days of the audit report and verification evidence within about 90 days for a major. Minors are often verified at the next surveillance audit. These timeframes come from the certification body’s own procedures rather than from ISO 27001, so confirm the exact dates in your audit report.
How many nonconformities are too many?
There is no numeric limit in ISO 27001. What matters is the pattern. A handful of unrelated minors at first certification is ordinary. Several minors pointing at one underlying weakness invites the auditor to group them into a major, and a repeat of a finding closed at the previous audit is treated seriously because it means the corrective action did not work.
Can you disagree with an auditor’s finding?
Yes. If you believe the requirement was met, or the evidence was misread, say so during the closing meeting while the auditor can still check. Every accredited certification body also has a formal appeals process set out in your contract. Disagree with the evidence and the requirement, not with the auditor, and bring the document that proves your case.
What is the difference between a nonconformity and an observation?
A nonconformity is a failure to meet a requirement and must be corrected. An observation, often called an opportunity for improvement, is a suggestion where nothing is actually broken. You are not obliged to act on an observation. It is still worth logging them, because an observation ignored for two years sometimes reappears as a finding once the situation has drifted.
Do minor nonconformities affect your surveillance audit?
Yes, indirectly. Your auditor will check at the next surveillance audit whether the corrective action worked. If the same issue recurs, it is likely to be escalated because a repeat finding indicates the corrective action process itself is not effective. See our guide to the ISO 27001 surveillance audit for what else is reviewed.
Treat findings as the system working
An audit that finds nothing in a young information security management system usually means the auditor did not look hard, not that your system is flawless. Findings are how the standard surfaces the gap between what you wrote down and what you do. Closing them properly, with a real root cause rather than a name, is what turns a certificate into something worth having. Standards Australia publishes the Australian adoption of the standard through Standards Australia if you need the source text.
Siege Cyber helps Australian organisations prepare for certification, close out findings and run internal audits that catch problems before the certification body does. Take a look at our ISO 27001 services or get in touch if you are holding a finding you are not sure how to close.