Audit nonconformities are inevitable. Even well-prepared organisations receive findings. The question isn’t whether you’ll have nonconformities—it’s how you’ll respond to them. A prompt, well-reasoned corrective action demonstrates system maturity. A slow or inadequate response suggests the opposite.

This guide walks through the most common nonconformities auditors find, how to classify them, and how to close them effectively and quickly.

Nonconformity Classification System

Not all audit findings are equal. Understanding the classification system is crucial to responding appropriately.

Major Nonconformity (NC)

A major nonconformity is a significant failure to meet ISO 45001 requirements. It’s not a procedural slip—it’s a systemic gap that indicates the system as a whole is not functioning.

Characteristics:

• Affects a critical process (e.g., HIRA, internal audit, management review, leadership commitment)
• Indicates the system is not operating as designed
• Poses risk to health and safety effectiveness
• Suggests lack of management or resource commitment

Examples:

• No hazard identification and risk assessment conducted (Clause 6.1)
• No internal audit programme in operation (Clause 9.2)
• No management review conducted (Clause 9.3)
• Critical staff not assessed for competence (Clause 7.2)
• No evidence of leadership commitment to health and safety (Clause 5.1)

Consequences: A major NC blocks certification at Stage 2. You cannot be certified until it’s closed. Major NCs must typically be closed within 3 months, verified by the certification body, before certification is granted.

Minor Nonconformity

A minor nonconformity is a procedural or implementation gap that doesn’t prevent the system from functioning overall. It’s a weakness in execution, not a fundamental system failure.

Characteristics:

• Affects a specific procedure or record
• Indicates incomplete implementation rather than system failure
• Isolated occurrence rather than systemic pattern
• Easily remediated through documentation or procedure update

Examples:

• One area’s hazard register not updated in 18 months (others are current)
• Missing signature on a training record
• One internal audit not conducted as scheduled
• Incomplete incident investigation (missing one element)
• One team not included in worker consultation

Consequences: Minor NCs don’t block certification, but they must be closed. Timeline is typically 6-12 months after audit. Multiple minor NCs (5+) may indicate systemic issues and could delay certification.

Observation

An observation is not a nonconformity. It’s an advisory finding. The system is working, but the auditor suggests an area for improvement.

Examples:

• “Your hazard identification is good, but consider more frequent updates.”
• “Your internal audit programme is solid, but you could broaden auditor participation.”
• “Your controls are effective, but you could enhance training on why these controls exist.”

Consequences: No corrective action required, but documenting your response to observations demonstrates commitment to improvement.

Opportunity for Further Improvement (OFI)

An OFI is a suggestion for future enhancement. It’s not critical—it’s merely an idea the auditor thought worth sharing.

Examples:

• “You might consider a digital hazard reporting system.”
• “Near-miss reporting could be incentivised to increase submissions.”

Consequences: No action required. These are optional ideas for future consideration.

Most Common Nonconformities by Clause

Auditors tend to find similar gaps in similar places. Understanding the most common nonconformities by clause helps you focus your preparation and remediation efforts.

Clause 5 (Leadership and Commitment)

Common Finding: Insufficient evidence of leadership commitment to health and safety.

Examples:

• Safety policy exists but isn’t communicated or understood at operational levels
• No evidence of leadership participation in safety activities (walkarounds, reviews, incident investigations)
• Budget allocation decisions show safety deprioritised against production or cost
• Management review shows minimal engagement or decision-making
• Safety issues aren’t escalated to board/executive level

How to Close: Document leadership actions: board safety updates, site walkarounds with evidence, management review meeting minutes showing decisions, resource allocation decisions, incident investigation participation by senior leaders. This isn’t about promises—it’s about demonstrable actions.

Clause 6.1 (Hazard Identification and Risk Assessment)

Most Common Finding: Hazard identification incomplete or outdated.

Examples:

• Hazard register doesn’t cover all operational areas
• Register hasn’t been updated when work processes changed
• Hazards identified by workers (in near-miss reports) aren’t added to HIRA
• Risk assessment incomplete—hazards identified but not properly assessed
• No evidence that new staff contribute to HIRA

How to Close: Conduct a comprehensive HIRA review covering all areas. Update for any new processes introduced since certification. Include recent incident and near-miss data. Have workers review and input. Document the review process. This isn’t a one-off fix—it’s a fresh HIRA audit.

Clause 6.2 (Determining Control Measures)

Common Finding: Controls documented but not actually implemented or verified as effective.

Examples:

• Procedure says “PPE is required” but workers don’t use it
• Engineering controls on a list but not installed
• Safety procedures written but workers unaware of them
• No evidence that controls actually prevent harm (no testing or verification)

How to Close: Verify every documented control. If it’s not implemented, either implement it or update your risk assessment to reflect current controls and residual risk. If it’s implemented, gather evidence of its effectiveness and worker understanding.

Clause 7.2 (Competence)

Common Finding: No documented evidence of competence assessment. Training attended ≠ competence.

Examples:

• Training attendance records exist but no assessment that competence was achieved
• New staff hired but no competence assessment completed
• Competence gaps identified but no plan for upskilling
• Critical roles (HIRA facilitator, auditor, investigator) assigned without competence verification

How to Close: Conduct competence assessments for all critical roles. Document what competence is required, what the person currently has, what gaps exist, and your plan to close gaps. Assessment must be more than attendance—it should be a quiz, practical demonstration, or supervisor sign-off confirming the person can do the job.

Clause 8.1 (Operational Control)

Common Finding: Procedures exist on paper but aren’t followed in practice.

Examples:

• Lockout/tagout procedure documented but not followed
• Hazard assessment procedure exists but assessments not done before new work
• Maintenance schedule documented but not adhered to
• Procedure is outdated and doesn’t match current operation

How to Close: Either enforce the procedure (retraining, supervision, verification of compliance) or update the procedure to match current practice. Demonstrate compliance through evidence: completed checklists, supervisor sign-offs, observation records.

Clause 9.2 (Internal Audit)

Most Common Finding: Internal audit programme not actually operating. Audits not conducted, findings not tracked.

Examples:

• Audit schedule created but audits not conducted
• One or more planned audits skipped or delayed
• Audits conducted but findings not tracked to closure
• Auditors lack competence or impartiality
• Audit reports are superficial with minimal evidence or detail

How to Close: Conduct all planned audits. Document findings with evidence. Implement corrective actions for findings. Verify closure. This is the fastest way to demonstrate your system self-regulates.

Clause 9.3 (Management Review)

Common Finding: Management review conducted but without genuine analysis or decision-making.

Examples:

• No management review conducted in the period audited
• Review minutes show no discussion of performance data
• Decisions documented but not implemented
• Review doesn’t address audit findings or incidents
• Same topics discussed year-on-year with no variation

How to Close: Conduct a comprehensive management review. Include audit findings, incident/near-miss trends, compliance status, staff feedback, performance data, and risk changes. Document discussions and decisions. Assign ownership for decisions. Track implementation.

Clause 10.2 (Nonconformity and Corrective Action)

Common Finding: Nonconformity procedure exists but isn’t consistently applied, or corrective actions don’t address root causes.

Examples:

• An incident occurred but investigation wasn’t documented
• Investigation doesn’t identify root cause
• Corrective action is superficial (e.g., “retrain everyone”) without addressing root cause
• No evidence that corrective action was implemented or verified as effective

How to Close: For each recent incident/nonconformity, ensure the file is complete: incident description, investigation findings, root cause analysis, corrective action plan, implementation evidence, effectiveness verification, closure sign-off. Use this as a template for future investigations.

Writing a Strong Corrective Action Response

When you receive a nonconformity, you must respond. Your response quality determines how the certification body views your organisation’s maturity. A weak response delays closure. A strong response demonstrates you understand the issue and have genuinely fixed it.

Structure of a Strong Corrective Action

A comprehensive corrective action response includes five elements:

1. Root Cause Analysis

Why did the nonconformity exist? Don’t just say “We forgot.” Dig deeper:

• Was the process not defined? (“We didn’t have a HIRA procedure”)
• Was the process defined but not communicated? (“Procedure existed but people didn’t know about it”)
• Was the process defined and communicated but not resourced? (“We had the procedure but no one assigned to do HIRA”)
• Was the process defined, communicated, resourced, but not enforced? (“People knew but no accountability for doing it”)

The root cause determines your fix. If it’s a knowledge gap, the fix is communication/training. If it’s a resource gap, the fix is resource allocation. If it’s an enforcement gap, the fix is management oversight.

2. Corrective Action Plan

What specifically will you do to fix the root cause? Be concrete:

Example (Weak): “We will ensure hazard identification is conducted more regularly and thoroughly.”

Example (Strong): “We will conduct a comprehensive HIRA review by [date], identifying all hazards in each operational area. We will document the process: list of people involved, hazards identified, risk assessment methodology applied, control measures selected. We will update our HIRA register and communicate the updated register to all staff by [date]. We will conduct quarterly HIRA reviews on a documented schedule with clear ownership assigned.”

Strong corrective actions have specifics: who, what, when, how.

3. Implementation Evidence

Once your corrective action is complete, gather evidence proving it was done:

• HIRA review meeting minutes and attendees list
• Updated hazard register with new date and sign-off
• Communication record (email, meeting, training) showing staff were notified
• Quarterly review schedule with first review already completed

Don’t just say “Done.” Show the evidence. This is how you prove closure.

4. Responsibility and Timeline

Who owns the corrective action? What’s the completion date?

Example: “Health and Safety Manager is responsible for conducting the HIRA review by [specific date]. Site Supervisors are responsible for implementing approved control measures by [date]. All staff will be notified by [date].”

Clear ownership prevents the corrective action from becoming nobody’s responsibility.

5. Verification of Effectiveness

How will you verify the fix actually worked?

Example: “We will verify HIRA effectiveness through: (1) Internal audit of the process in Q3 2026; (2) Management review assessment of whether hazard identification is now routine; (3) Follow-up audit by certification body.”

This shows you’re not just fixing the problem—you’re ensuring the fix stays fixed.

Closure Timelines and How to Meet Them

Your certification body will specify closure timelines in the audit report. Missing deadlines has consequences.

Typical Timelines

• Major NC: Typically 3 months from audit to closure verification
• Minor NC: Typically 6-12 months from audit to closure verification

How to Meet Timelines

Immediate: Within 1-2 weeks of receiving the audit report, submit your corrective action response to the certification body. Don’t wait. Show you’re taking it seriously.

Implementation: Complete the corrective action on your planned timeline. If you said “by [date],” deliver by that date. If circumstances change, notify the certification body and request timeline adjustment.

Evidence Submission: 1-2 weeks before the closure deadline, submit your implementation evidence to the certification body. This gives them time to review and ask questions.

Verification: The certification body will review documentation or conduct a follow-up audit. Respond promptly to any questions. Provide additional evidence if requested.

Closure: Once the certification body accepts your evidence, they’ll issue closure confirmation.

From the auditor’s perspective, organisations that submit corrective action responses immediately, meet timelines, and provide clear evidence are professional. Organisations that miss deadlines or provide vague responses are concerning.

Preventing Repeat Nonconformities

The worst outcome is finding the same nonconformity in a subsequent audit (internal, surveillance, or recertification). This signals you haven’t genuinely fixed the root cause.

How to Prevent Recurrence

• Track Beyond Closure: After the certification body accepts your corrective action as closed, don’t forget about it. Include the area in your internal audit programme. Monitor it at management reviews.
• Embed the Fix: Make the corrective action part of normal operations. If you’ve improved your HIRA process, it should now be routine, not a one-off fix.
• Communicate Widely: Don’t just tell the person responsible. Brief your whole team on what changed and why. This prevents people from reverting to old practices.
• Verify Persistence: Use your internal audit programme to verify the fix is still in place 3-6 months after closure. If you find slippage, address it immediately before the next external audit.
• Learn from It: Share the lesson across your organisation. If one team had this nonconformity, is it likely others could have the same issue? Implement controls across the board.

Repeat nonconformities are viewed very negatively. If you’ve had a nonconformity once, you should have systems in place to prevent it recurring. If it recurs, you’re signalling that you’re not genuinely managing your system.

Common Corrective Action Mistakes

Some corrective actions fail because they miss the mark. Here are common mistakes:

Mistake 1: Blaming External Factors

Example: “We didn’t conduct management review because we were busy with production demands.”

This isn’t a root cause—it’s an excuse. The real root cause is that you didn’t prioritise management review. The corrective action isn’t “We’ll be less busy.” It’s “We’ll schedule management review quarterly regardless of production demands and ensure someone is accountable for it.”

Mistake 2: Training as a Catch-All Solution

Example: “We found that staff weren’t following the procedure. We’ve retrained everyone.”

Training is sometimes the answer. But if staff weren’t following a procedure they already knew, training won’t help. The issue is enforcement, not knowledge. The corrective action should address why people weren’t following it and what management oversight will ensure they do.

Mistake 3: Superficial Fixes

Example: “We found hazard identification incomplete. We’ve updated the register to include three more hazards.”

This isn’t a fix—it’s a band-aid. The root cause is your process wasn’t thorough. The fix is to redesign the HIRA process to be more comprehensive, conduct a full review, and implement ongoing quarterly reviews.

Mistake 4: No Accountability

Example: “We will improve our internal audit programme.”

Who’s responsible? By when? What specifically will improve? Without accountability and specifics, the corrective action isn’t credible.

Mistake 5: No Verification Plan

Example: “We’ve implemented the control measure.”

How will you verify it’s working? Will someone check? How often? Without verification, you don’t know if the fix is effective.

Key Takeaways

Nonconformities are normal. What matters is how you respond. A prompt, well-reasoned response demonstrates that your organisation takes its system seriously. A weak or late response signals the opposite.

Understand the classification system (major vs. minor). Identify the root cause. Design a specific corrective action. Implement thoroughly. Gather evidence. Meet deadlines. Verify effectiveness. This is how you transform nonconformities from problems into improvements.

The organisations that pass audits with minimal repeat findings are those that treat nonconformities as learning opportunities, not obstacles. Use them to strengthen your system.

Conclusion: Nonconformities as Improvement Catalysts

Audit nonconformities aren’t failures—they’re feedback. Smart organisations use them as catalysts for improvement. They identify gaps, drive corrective action, and create stronger systems.

When you receive a nonconformity, resist the temptation to blame external factors or apply superficial fixes. Investigate root cause. Design a thorough corrective action. Implement diligently. Verify effectiveness. Meet timelines. This is how you build a system that genuinely improves.

Related Articles

• ISO 45001 Certification: The Complete Pathway Guide
• ISO 45001 Stage 1 and Stage 2 Audit: What to Expect and How to Prepare
• ISO 45001 Internal Audit: How to Plan, Conduct and Report Effectively
• ISO 45001 Nonconformity and Corrective Action: The Complete Process