Minor Nonconformity
Definition
A single lapse or gap that does not indicate systemic failure. The organisation must provide a corrective action plan and close the finding before the next audit. Repeated minor nonconformities in the same area can be upgraded to major.
- Standard context
- ISO/IEC 27001 audits
- Requires
- Corrective action plan before the next audit
- Escalation risk
- Repeated instances can be upgraded to major
- Indicates
- A single lapse, not systemic failure
Common questions
How does a minor nonconformity differ from a major one in an ISO 27001 audit?+
A major nonconformity indicates a systemic breakdown or an absence of a required control altogether, and can jeopardise certification immediately. A minor nonconformity is an isolated gap in an otherwise functioning control, allowing the organisation time to submit and close a corrective action plan without losing certification.
What triggers an upgrade from minor to major nonconformity?+
A pattern of repeated minor findings in the same control area across audit cycles suggests the underlying process is not effective, not just occasionally lapsing, and an auditor can reclassify the recurring issue as major on that basis.
Does a minor nonconformity stop certification from being granted or maintained?+
No, certification can proceed or continue, but the organisation must formally document and close the corrective action before the next surveillance audit, or the unresolved finding can be escalated at that point.
Related terms
- Accreditation Body (AB)
- A national body that assesses and formally recognises the competence of certification bodies. Notable examples: UKAS (UK), DAkkS (Germany), COFRAC (France), NABCB...
- Certification Body (CB)
- An independent third-party organisation accredited to audit and certify that an ISMS conforms to ISO 27001. Examples include BSI, Bureau Veritas, DNV,...
- Major Nonconformity
- A finding that indicates the ISMS is absent in a required area or has failed systemically. Must be resolved with verified evidence...
- Stage 1 Audit
- The documentation review phase of the initial certification audit. The auditor checks that the ISMS documentation exists, the scope is defined, the...
- Stage 2 Audit
- The on-site certification audit. The auditor tests whether controls described in the documentation are implemented and operating effectively. A Stage 2 pass...