Grading Nonconformities: Major, Minor and the Grey Zone

Why Getting the Grade Right Matters

Every auditor reaches a point in their career where they find something that clearly needs to be raised, but they are not sure whether it is a major or a minor. It is one of the most common points of uncertainty in audit practice, and it has real consequences. Grade something too high and you create unnecessary alarm, damage relationships, and potentially jeopardise a certification that the organisation has worked hard to achieve. Grade something too low and you understate the risk, the organisation does not respond with appropriate urgency, and the problem persists.

Grading nonconformities is a professional judgement call. It is not purely mechanical. There is no formula that spits out an answer. What there is, however, is a set of principles, criteria, and practical tests that experienced auditors apply consistently. This article walks through those criteria in plain terms, with real examples from across ISO 9001, ISO 14001, ISO 45001, and ISO 27001 audits.

If you want to understand how ISO 19011:2026 has updated expectations around grading, that article covers the standard guidance in detail. Here, the focus is on practical application.

The Definitions You Actually Need

Before getting into application, it helps to be clear on what the terms mean in practice, not just in theory.

What Is a Nonconformity?

A nonconformity is a failure to fulfil a requirement. That requirement could come from the standard itself, from the organisation's own documented procedures, from legal obligations, or from customer requirements that the organisation has committed to meet. ISO 9000:2015 defines it simply as non-fulfilment of a requirement.

The key word is requirement. If there is no requirement, there is no nonconformity. This matters because auditors sometimes raise findings against things they personally think are good practice but which are not actually mandated. That is an observation or an opportunity for improvement, not a nonconformity.

Major Nonconformity

A major nonconformity is a failure that affects the ability of the management system to achieve its intended outcomes. It is a significant or systematic failure. In the context of certification audits, a major nonconformity typically prevents certification from being recommended, or triggers a suspension of existing certification until it is resolved.

Common characteristics of a major include: absence of a required process, complete breakdown of a critical control, a pattern of repeated failures across multiple instances, or a finding that directly exposes the organisation or others to significant risk.

Minor Nonconformity

A minor nonconformity is a single, isolated lapse that does not undermine the overall effectiveness of the management system. The process or control exists and generally works, but there is a specific instance where it has not been followed or has produced an incorrect result.

The system is fundamentally sound. The finding is a reminder to tighten up, not a signal that the whole approach is broken.

The Four Tests Experienced Auditors Apply

When you are sitting with a finding and trying to decide on the grade, work through these four tests. They will not always give you a clean answer, but they will focus your thinking.

Test 1: Is This Isolated or Systematic?

An isolated instance is almost always a minor. A pattern across multiple people, locations, time periods, or product lines is almost always a major. This is the most reliable test in practice.

Say you are auditing calibration records under ISO 9001 Clause 7.1.5. You sample twelve measuring instruments and find one that is overdue for calibration by three weeks. That is a minor. The calibration programme exists, it is generally followed, and one instrument has slipped through. Now say you sample twelve instruments and find four that are overdue, two with no calibration history at all, and the calibration register has not been updated in six months. That is a major. The system is not functioning.

The sample size matters here. How many records you pull affects how confidently you can characterise something as isolated or systemic. If you only sampled three records and found one problem, you cannot be certain it is isolated.

Test 2: Does This Affect the Intended Outcome of the System?

This is the question that ISO 19011 points you toward when distinguishing severity. Ask yourself: if this failure continues, does it undermine what the management system is supposed to achieve?

For an OH&S system under ISO 45001, the intended outcome is the prevention of work related injury and ill health. A missing risk assessment for a high risk task is not just a paperwork gap. It means the organisation has no systematic basis for controlling that hazard. That affects the intended outcome. It is a major.

Contrast that with a situation where the risk assessment exists and the controls are implemented, but the review date has passed and the document has not been formally re-evaluated. The control is still working. The outcome is not immediately compromised. That is a minor.

Test 3: What Is the Consequence of This Failure?

Actual or potential consequence is a legitimate factor in grading. An auditor is not just checking boxes. They are assessing risk.

A documented information control failure where a superseded procedure is still accessible on the shared drive is a minor in most contexts. But if that superseded procedure governs a safety critical process, and workers are actively using it, the consequence potential is severe. The grade should reflect that.

In ISO 27001 audits, this test is particularly important. A missing access review for a low risk internal system is a minor. A missing access review for a system holding sensitive customer data, where former employees may still have active accounts, is a major. Same clause, different consequence.

Test 4: Is This a Complete Absence or a Partial Failure?

Complete absence of a required element almost always warrants a major. Partial implementation that falls short in a specific instance is usually a minor.

If an organisation has no internal audit programme at all, that is a major against Clause 9.2 of whichever standard you are auditing. The requirement simply has not been addressed. If the internal audit programme exists and is mostly followed, but one process area was missed in the last cycle without documented justification, that is a minor. The programme is real. There is a gap in execution.

The Grey Zone: When It Is Genuinely Hard to Call

There are findings that do not sit cleanly in either category. This is the grey zone, and it is where professional judgement is most tested. Here are the most common grey zone scenarios and how to work through them.

Multiple Minors in the Same Area

This is the scenario that trips up new auditors most often. You find three separate minor nonconformities all relating to the same process or clause. Each one, on its own, is clearly a minor. But together, they suggest the process is not under control.

In this situation, you have two legitimate options. You can raise them as three separate minors and note in your audit report that the pattern is concerning. Or you can consolidate them into a single major, on the grounds that the cumulative evidence points to a systematic failure.

The right choice depends on the evidence. If the three minors are genuinely unconnected instances that happen to fall under the same clause, raise them separately. If they share a common root cause and together indicate the process is not functioning, consolidate to a major. Document your reasoning either way.

A Significant Finding With Mitigating Controls

Sometimes you find a gap in one control, but there is a compensating control that is working effectively. The risk is real but partially mitigated.

For example, in an ISO 27001 audit, you find that patch management for a particular server group is months behind. That is serious. But you also find that those servers are isolated on a network segment with strict access controls and are monitored continuously. The vulnerability exists, but the organisation has not left it completely unmanaged.

In this case, the finding still needs to be raised. The patch management requirement exists regardless of compensating controls. But the mitigating factors are relevant to how you characterise the risk in your narrative. The grade should still reflect the severity of the gap, not be inflated by the fact that compensating controls exist, nor deflated to the point where the urgency is lost.

Legal and Regulatory Breaches

Any finding that involves a breach of a legal or regulatory requirement should be treated with particular seriousness. Even if the breach appears isolated, the legal exposure and the potential for harm to people or the environment typically warrants a major.

Under ISO 14001, if an organisation is discharging effluent in excess of its licence conditions, that is a major regardless of whether it is a one-off event. The standard requires compliance with legal obligations, and a breach is a breach. The same principle applies to ISO 45001 situations involving breaches of WHS legislation.

The “They Knew About It” Scenario

Occasionally you discover that the organisation was already aware of the issue before the audit. They identified it through their own monitoring, internal audit, or incident investigation, and they have a corrective action in progress.

This does not eliminate the nonconformity. The finding still needs to be raised because the requirement has not been met. What it does affect is the narrative and potentially the severity assessment. If the organisation has already identified the root cause, implemented interim controls, and is partway through a systematic fix, that context belongs in your report. It does not change the grade, but it changes how the finding is presented and what corrective action is required from the auditee.

Practical Examples Across Standards

ISO 9001: Quality Management

Minor: During a supplier evaluation audit, you find that two supplier performance reviews from the previous year are missing from the records. The supplier evaluation process exists, is generally followed, and the other ten reviews are on file and current. One or two gaps in an otherwise functioning process is a minor against Clause 8.4.

Major: The organisation has no documented criteria for evaluating or selecting new suppliers. Any supplier can be approved without any formal assessment. The control does not exist. That is a major against Clause 8.4.1.

ISO 14001: Environmental Management

Minor: The environmental aspects register has been reviewed within the required timeframe, but one new activity added six months ago has not been assessed for its environmental aspects. The register is live and generally current. This is a minor against Clause 6.1.2.

Major: The organisation has not updated its legal register in two years, is unaware of three legislative changes that affect its operations, and has no process for monitoring changes to compliance obligations. This is a major against Clause 6.1.3. The compliance management system is not functioning.

ISO 45001: OH&S Management

Minor: A safe work method statement for a routine maintenance task has not been reviewed following a minor change to the equipment. The SWMS is otherwise accurate and the task is being performed safely. Minor against Clause 8.1.1.

Major: Workers are performing work at height without any documented risk assessment, no fall protection controls have been determined, and no SWMS exists for the activity. This is a major against Clause 6.1.2 and Clause 8.1.1. The hazard has not been assessed and controls have not been implemented. The intended outcome of preventing injury is directly at risk.

ISO 27001: Information Security

Minor: The information security awareness training programme is in place and most staff have completed it, but three employees who joined in the last quarter have not yet been enrolled. Minor against Clause 7.2 or 7.3, depending on how you frame the finding.

Major: There is no process for revoking access when employees leave the organisation. A review of the active user accounts reveals that seventeen former employees still have active credentials to business systems. This is a major against Annex A controls relating to access management. The control does not exist and the risk exposure is direct and current.

Writing the Finding Once You Have Graded It

The grade is only as useful as the write-up that supports it. A major nonconformity that is poorly written will be disputed at the closing meeting. A minor that is clearly evidenced and well articulated will be accepted and acted on.

Every nonconformity, regardless of grade, needs three things: the requirement that has not been met, the objective evidence that demonstrates the failure, and a clear statement of what was found. The grade follows from the evidence, not from your gut feeling about the organisation.

For guidance on structuring the write-up itself, the article on writing nonconformity reports that stand up to scrutiny covers the format and language in detail. And if you want to understand how findings more broadly are classified, including where observations and opportunities for improvement fit in, classifying findings as NC, OFI and observation is worth reading alongside this article.

Defending Your Grade at the Closing Meeting

When you present your findings at the closing meeting, you need to be ready to explain your grading decision. Auditees will sometimes push back, particularly on majors. That is normal and expected.

The way to defend a grade is not to dig in and assert authority. It is to return to the evidence and the criteria. Explain what you found, explain which requirement it relates to, and explain which of the severity criteria it meets. If the auditee presents new information that genuinely changes the picture, be willing to reconsider. That is not weakness. That is professional judgement operating as it should.

What you should not do is downgrade a finding because the auditee is upset, because the relationship feels tense, or because you want to avoid conflict. The integrity of the audit depends on findings being graded on their merits.

Building Grading Confidence Through Training and Practice

Grading nonconformities well is a skill that develops with practice. New auditors often err in one direction or the other. Some are reluctant to raise majors and end up with a report full of minors that should have been elevated. Others apply major grades too broadly and undermine their credibility with auditees and audit programme managers.

The fastest way to calibrate your judgement is to audit alongside experienced auditors, review real audit reports, and discuss grading decisions with colleagues who will challenge your reasoning. Lead auditor training that includes realistic practice scenarios and graded exercises is particularly valuable for this.

At Audit Workshop, the Lead Auditor courses across ISO 9001, ISO 14001, ISO 45001, and ISO 27001 include practical grading exercises drawn from real audit scenarios. Trainees work through findings, apply the criteria, and defend their decisions. That kind of deliberate practice is what builds the confidence to make grading calls under pressure in the field.