Why companies fail ISO 9001 audits: the most common nonconformities by clause

A nonconformity in an ISO 9001 audit is not necessarily a sign that quality is poor. It is a sign that the organisation cannot demonstrate, with objective evidence, that a specific clause requirement is consistently met. Auditors are trained to ask for evidence, not assurances — and this is precisely where well-run organisations still stumble on their first certification attempt.

Major vs minor nonconformities — why the distinction matters

Certification bodies classify findings into two categories. A minor nonconformity is an isolated lapse that does not affect the overall capability of the QMS — for example, one training record missing a signature. A major nonconformity is a systemic failure, the absence of a required process altogether, or an accumulation of minor findings against the same clause that together indicate the system is not functioning. Major nonconformities block certification until they are corrected and verified, typically requiring a follow-up audit visit. Minor nonconformities usually allow certification to proceed, with correction verified at the next surveillance audit.

The nonconformities described below are the ones that most often tip from "minor, isolated finding" into "major, systemic finding" — because they tend to recur across multiple clauses and processes when the underlying documentation discipline is weak.

1. Incomplete or uncontrolled documented information (Clause 7.5)

Clause 7.5 requires that documented information be identified, reviewed, approved, and kept current — and that obsolete versions are removed from circulation or clearly marked. In practice, auditors most often find:

• Procedures that do not match actual practice. The written procedure says one thing; the operator on the shop floor does another. This is one of the single most common findings in initial certification audits, because documentation is often written by quality staff without full input from the people who execute the process.
• Superseded revisions still in use. A work instruction is updated centrally but the printed copy at the workstation is an older revision. Auditors routinely check the revision number on the wall against the master list.
• Missing approval or review evidence. A document exists but there is no record of who approved it, when, or against what criteria — Clause 7.5.2 requires suitability and adequacy to be confirmed before issue.
• No clear document control procedure at all. Version numbering is inconsistent, there is no master document list, and nobody can say with confidence which is the current version of a given form.

How to avoid it: before the initial audit, run a full document control reconciliation — every controlled document should appear on a single master list with current revision number, approval date, and approver. Withdraw or clearly mark obsolete copies at the point of use. If your organisation has grown by acquisition or has documentation scattered across shared drives, email threads, and paper binders, this reconciliation is the single highest-leverage task before the audit.

2. Missing or superficial management review evidence (Clause 9.3)

Clause 9.3 requires top management to review the QMS at planned intervals and specifies a defined set of inputs (status of previous actions, changes in external/internal issues, customer satisfaction and feedback, quality objective performance, process performance and product conformity, nonconformities and corrective actions, monitoring and measurement results, audit results, and the performance of external providers) and outputs (opportunities for improvement, any need for changes to the QMS, resource needs).

A very frequent audit finding is that management review did happen — leadership genuinely does discuss quality performance in board or operations meetings — but there is no dedicated record showing that the specific required inputs were covered and that the required outputs were decided and actioned. When the auditor asks "show me the record of your last management review and how each of these nine inputs was addressed," a general set of meeting minutes rarely satisfies the requirement.

How to avoid it: use the nine inputs of Clause 9.3.2 as a literal agenda template for your management review meeting, and record the outcome against each item, even briefly. Keep the record as a standing document — minutes, an action log, or a structured template — so that any auditor can trace, input by input, that the review was substantive rather than a formality.

3. Nonconformities identified but never properly closed (Clause 10.2)

Clause 10.2 requires that when a nonconformity occurs, the organisation reacts to it, evaluates the need for action to eliminate the cause (not just the symptom), implements the action, reviews its effectiveness, and updates risks and the QMS if necessary. A very common finding is a nonconformity register full of entries where the immediate correction is recorded — the defective part was scrapped, the customer complaint was answered — but there is no documented root-cause analysis and no evidence that anyone checked, weeks or months later, whether the same problem recurred.

Auditors will typically pull a sample of nonconformity records, both from internal audits and from operational/customer complaints, and trace them end-to-end. Gaps auditors commonly flag:

• Root cause recorded as "operator error" with no further analysis of why the error was possible in the first place (a training gap, an ambiguous work instruction, a missing poka-yoke).
• Corrective action defined but no target date, owner, or verification step.
• No effectiveness check — the action was closed the same day it was raised, with no evidence the problem stopped recurring.
• Internal audit findings that were never fed into the same corrective action process used for operational nonconformities, creating two disconnected systems.

How to avoid it: before the audit, review your own nonconformity log as if you were the auditor. Pick five closed items at random and ask: is the root cause credible, is there a named owner and date, and is there evidence the fix actually worked? If you cannot answer all three for a sample of your own records, the auditor will not be able to either.

Other frequent findings worth checking before the initial audit

Why these gaps recur: it is a retrieval problem, not a compliance problem

In most organisations preparing for certification, the underlying quality practices genuinely exist — training does happen, suppliers are informally vetted, problems do get fixed. What fails the audit is the organisation's ability to instantly locate and present the specific evidence, in the specific format, that the standard requires. Documentation is scattered across shared drives, email inboxes, and the memory of long-tenured staff. When an auditor asks for the management review record from eighteen months ago, or the training file for an employee who has since changed roles, the delay and uncertainty in producing it is itself often treated as a finding.

This is exactly the gap IgeraIndustria closes. Rather than restructuring your QMS, IgeraIndustria indexes the documentation you already have — procedures, training records, supplier evaluations, nonconformity logs, management review minutes — and makes it instantly retrievable with the exact clause, document, and revision cited. Before you invest in a full consultancy-led pre-audit, it is worth checking exactly how much a certification would cost for your company and organisation size, since the audit fee itself is only a fraction of the total preparation cost. You can calculate the exact cost for your company using the free ISO 9001 certification cost calculator before committing to a certification body or consultancy.

A practical pre-audit checklist

In the weeks before your initial certification audit, walk through these checks in order of how frequently they generate findings:

• Document control: one master list, current revisions only at points of use, clear approval records.
• Management review: a dedicated record covering all nine Clause 9.3.2 inputs and the resulting outputs, not just general meeting minutes.
• Nonconformity and corrective action: root cause beyond "human error," a named owner and date, and a documented effectiveness check.
• Quality objectives: measurable, monitored, and known by the people responsible for them.
• Competence records: training matrix matches actual personnel files.
• Internal audit programme: full QMS scope covered, auditor independence maintained.
• Supplier evaluation: current records for every critical external provider.

None of these require new processes — they require making the evidence for existing processes easy to find, complete, and consistent. That discipline is what separates organisations that pass their initial certification audit cleanly from those that walk away with a list of major nonconformities and a follow-up visit to schedule.

Frequently asked questions

What happens if I get a major nonconformity during the initial certification audit?

Certification is withheld until the major nonconformity is corrected. You will need to submit a corrective action plan showing root cause and remedy, and in most cases the certification body will conduct a follow-up visit (sometimes a full or partial on-site audit, sometimes a documented review, depending on the nature of the finding) to verify the correction before the certificate is issued.

How many minor nonconformities are acceptable before certification is blocked?

There is no fixed numeric limit in the standard itself — it depends on the certification body's procedures and the auditor's judgement. However, a cluster of minor nonconformities against the same clause, or across several interrelated clauses, is often reclassified as a major nonconformity because it suggests a systemic rather than isolated issue.

Should we run an internal audit before the certification body's initial audit?

Yes. Clause 9.2 requires an internal audit programme regardless, and running at least one full-scope internal audit (or engaging a consultant to run a mock external audit) before the certification body arrives is the single most effective way to surface documentation and evidence gaps while there is still time to fix them.

Do auditors expect perfection, or is some imperfection normal?

Auditors expect a functioning system with evidence of continual improvement, not a flawless one. Minor nonconformities are common even in well-run organisations and do not usually block certification. What auditors are actually testing is whether the organisation can identify its own gaps and correct them — which is why an unresolved nonconformity register is a more serious finding than the existence of nonconformities themselves.

Article reviewed by IgeraIndustria Quality Team, updated 2026-08-02. References: ISO 9001:2015 Quality management systems — Requirements, Clauses 7.5, 9.2, 9.3, 10.2; published audit guidance from UKAS-accredited certification bodies including BSI, Bureau Veritas, SGS, LRQA, and DNV; IAF/ISO guidance on nonconformity classification.