What Nonconformity Means in an Audit

You're on your monthly inspection round at your company's warehouse in Damascus. Your internal procedure requires emergency exits to stay clear at all times, safety law mandates it, and ISO 45001 requires it too. Yet you find the east exit blocked by eight pallets from a shipment that arrived yesterday. The warehouse keeper tells you: "It's temporary — we just got a big shipment in."

You have two options: look away because it's "temporary," or document what you saw. The difference between those two options is the difference between a system that works and a system that pretends to. What you saw has a precise name: a nonconformity (NC for short) — failure to meet a requirement. That requirement might come from the standard, from the law, or from your own internal procedures that you committed yourself to; the blocked exit violates all three at once.

A wording that survives any review

A well-written nonconformity has three components:

1. The requirement: What was supposed to be true? "The internal safety procedure and emergency-preparedness requirements state that emergency exits must remain clear at all times."
2. The reality: What was actually found? "The warehouse's east exit was found blocked by eight pallets on [date], at 10:00 AM."
3. The evidence: What proves the reality — a timestamped photo, the shipment receipt number.

Compare this to the statement "safety in the warehouse is weak": it can't be addressed, can't be disputed, and can't be verified as closed. The test is simple: can someone who wasn't on the inspection round understand from your write-up what was required and what was found, and later confirm the issue was closed? If yes, your wording is correct.

Note that the periodic inspection isn't the only source: you might discover a nonconformity through an internal audit, through investigating an incident or near miss, through a worker's or customer's complaint, or by reviewing the records themselves. The source varies; the three-part wording and the path that follows it do not.

Major or minor

Nonconformities are classified into two grades:

• Major: A fundamental failure that threatens the system's effectiveness — a requirement that's completely absent, a disabled control for a high-level hazard, or a systemic recurrence indicating the system doesn't act on what it detects.
• Minor: An isolated lapse that doesn't undermine the system but still needs to be addressed.

Apply that to our example: an exit blocked once, caught by your own periodic inspection, and resolved — likely minor. But the same exit blocked in three consecutive rounds without being fixed is no longer a problem with the pallets; it's a problem with a system that detects but doesn't act — and that may well rise to major. The grade doesn't describe the event alone; it describes what the event says about the system.

The grade also carries a practical cost in external audits: minors typically pass with a mandatory corrective-action plan on a deadline, while majors can suspend certification or its renewal until closed and verified by the auditor. That's why it matters to catch majors internally before someone else does.

Whether major or minor, the path is the same:

1. Correct immediately (Correction): remove the pallets now — the hazard is live and won't wait.
2. Document the nonconformity with its three components and classify it.
3. Open a Corrective Action that investigates the Root Cause and prevents recurrence — the subject of our next lesson in detail.
4. Verify closure with evidence, not a promise.

Before any of that, set your mindset right: the auditor doesn't penalize you for having nonconformities — they assess how you detect and address them. A record with zero NCs doesn't suggest perfection; it suggests no one is inspecting seriously.

Common mistakes

1. Prettifying. Logging a nonconformity as a "note" or "improvement opportunity" so the record doesn't look too heavy. The result is a system that loses its memory: the problem recurs with no trace linking its recurrences, so no one catches the pattern. External auditors usually catch this prettifying — and a dressed-up record leaves a worse impression than a full one.
2. Vague description. "Cleanliness below standard," with no reference requirement, no evidence, no place or time. What can't be measured can't be closed.
3. Closing on the spot correction. "We removed the pallets — closed." No one asked why they were put there in the first place, and they'll be back with the next shipment. Correction extinguishes the incident; it doesn't extinguish its cause.

In goiso

Inspections in goiso run on a kanban board where cards get pulled toward closure. The moment you mark a clause in an inspection card as nonconforming, the platform raises a nonconformity linked to that card, and the effect ripples across the compliance surface: the clause in question turns red, and it doesn't turn green again except through resolution and evidence. This way, no NC gets lost in a forgotten notebook. See What Do I Do With a Nonconforming Clause in an Inspection and How Do I Use the Inspections Board.

Summary

• A nonconformity (NC) = failure to meet a requirement — from the standard, the law, or your own procedures.
• Correct wording has three parts: the requirement, the reality, the evidence.
• Major if it threatens the system or reveals a systemic recurrence; minor if it's an isolated lapse.
• The spot correction doesn't close it; addressing the root cause and verifying with evidence does.

You removed the pallets today — but what stops next week's shipment from blocking the exit again? Nothing, so far. That's exactly the job of Corrective Action (CAPA), our next lesson.