The audit starts normally. The auditor asks for a procedure, checks a few records, talks to an employee, and then pauses.
Something doesn’t match.
The procedure says one thing, but the employee is following another. A corrective action was marked complete, but there is no evidence that it actually worked. An internal audit was completed, yet the same issue somehow made it through to the certification audit.
Now there is an NCR (Nonconformity Report) to deal with.
These situations are common because ISO audits do not simply check whether documents exist. Auditors look for objective evidence that requirements are understood, implemented, monitored, and maintained in practice.
A nonconformity identifies a gap between a requirement and what is actually happening. Addressing that gap effectively means more than fixing the immediate problem. The cause needs to be understood, corrective action needs to be taken, and its effectiveness needs to be verified.
The ISO/IAF Auditing Practices Group similarly identifies correction, cause analysis, and corrective action as key parts of responding to a nonconformity, with auditors expected to verify the effectiveness of actions taken.
Here are some of the most common ISO audit nonconformities and how to address them.
What Is an ISO Audit Nonconformity?
A nonconformity occurs when a requirement is not fulfilled. The requirement may come from the applicable ISO standard, the organization’s own procedures, customer requirements, or applicable legal and regulatory requirements.
During an audit, a nonconformity should be supported by clear evidence showing:
- What was observed: The objective evidence found during the audit
- What was required: The applicable requirement
- What was wrong: The specific gap between the requirement and the evidence
The finding may then be documented through an NCR (Nonconformity Report). A non-conformance management process provides a structured way to document the issue, assign responsibility, investigate the cause, implement corrective action, and track the finding through closure.
The important distinction is that correcting the immediate problem is not always the same as correcting its cause.
For example, replacing an obsolete procedure at a workstation corrects the immediate issue. Finding out why the obsolete procedure reached that workstation and improving the document control process addresses the cause.
Common Nonconformities Found in ISO Audits
1. Outdated or Uncontrolled Documented Information
Document control remains a common source of audit findings.
An organization may have a documented procedure, but employees may be using an older version. Documents may lack clear revision status or approval, while records may be incomplete or difficult to retrieve.
What an auditor may find:
- An employee using an obsolete work instruction
- A procedure that has not been reviewed after a process change
- Missing approval or revision information
- Different versions of the same document in circulation
- Records that cannot be traced to the relevant process or activity
How to address it:
Correct the immediate document issue first. Then determine why the outdated or uncontrolled information was available in the first place.
Review how documents are created, reviewed, approved, revised, distributed, and withdrawn. The goal is not simply to replace one document. It is to make the document control process reliable enough to prevent the same issue from recurring.
2. Corrective Actions That Do Not Address the Root Cause
Another common finding occurs when an organization closes a problem without addressing why it happened.
For example, a company discovers repeated product defects and retrains the operator involved. If the same defect occurs again, the training may have addressed the symptom without addressing the underlying cause.
What an auditor may look for:
- Repeated nonconformities
- Root-cause analysis that stops at “employee error”
- Corrective actions that only address the immediate problem
- No evidence that corrective action was effective
- Findings that are repeatedly reopened
How to address it:
Start with the NCR and clearly define what happened and which requirement was not fulfilled.
Then separate three activities:
Correction: What needs to be fixed now?
Cause analysis: Why did the nonconformity happen?
Corrective action: What needs to change to prevent recurrence?
Finally, define how effectiveness will be checked. Closing an action because the assigned task was completed is not the same as demonstrating that the corrective action worked.
3. Internal Audits That Do Not Identify Real Problems
Internal audits should provide an honest view of whether the QMS is working as intended. A common weakness is an audit programme that focuses on completing checklists rather than evaluating actual processes.
An organization may have completed its required audits and still receive external audit findings because the internal audits did not test whether procedures were actually being followed.
A strong internal audit programme looks beyond documentation and examines actual practices, evidence, and process effectiveness.
What an auditor may find:
- Internal audits that rely entirely on generic checklists
- Repeatedly clean audit reports despite known process problems
- Incomplete audit coverage
- Weak evidence supporting audit conclusions
- Findings that are identified but not followed through
How to address it:
Build internal audits around processes and their risks, not simply around paperwork.
Auditors should review actual evidence, speak with people performing the work, and follow processes from inputs to outputs.
The results should also feed into corrective action and improvement. A useful internal audit should help the organization identify weaknesses before an external auditor does. Audit management can help teams keep audit findings, assigned actions, and follow-up connected from the initial audit through closure.
4. Processes Are Not Being Performed as Documented
Sometimes the procedure itself is adequate. The problem is that the actual process does not match it.
For example, a procedure may require a final inspection before product release, but records show that the inspection is being performed after release or is being skipped altogether.
This creates a gap between the documented system and the implemented system.
How to address it:
First, determine whether the documented process is still appropriate.
If it is, identify why employees are not following it. Possible causes may include inadequate training, unclear responsibilities, impractical instructions, poor communication, or a process that changed without the documentation being updated.
If the actual process has legitimately changed, update the relevant documented information and ensure the change is controlled and communicated.
5. Incomplete Evidence of Competence and Training
Having a training programme does not automatically demonstrate competence.
Auditors may look for evidence that people performing work affecting the QMS have the necessary competence and that the organization retains appropriate evidence of it.
What an auditor may find:
- Missing training records
- Training completed without evidence of competence
- Job requirements that do not match actual responsibilities
- New employees performing quality-critical activities without adequate evidence of qualification
- Training records that are difficult to trace to employees or roles
How to address it:
Review the competence requirements for relevant roles and identify where evidence is missing.
Then make the records useful rather than simply complete. Depending on the activity, evidence may include training records, qualification results, practical assessments, certifications, or other appropriate evidence of competence.
The goal is to demonstrate not only that someone attended training, but that they can perform the work effectively.
6. Management Reviews That Do Not Lead to Meaningful Action
Management review can become a meeting where required information is presented, minutes are recorded, and little else happens.
A stronger management review uses QMS information to identify issues, evaluate performance, and determine actions.
What an auditor may find:
- Missing required inputs
- Repeated discussions with no follow-up
- Actions without clear ownership
- No evidence that previous actions were reviewed
- Quality performance information that does not lead to decisions
How to address it:
Review whether management review outputs are clearly documented and followed through.
Actions should have appropriate ownership, timelines, and evidence of completion. More importantly, management review should connect quality performance with decisions about resources, process changes, risks, opportunities, and improvement.
7. Risk Assessments Are Not Connected to Actual Controls
Risk-based thinking can become a paperwork exercise when risk registers are created but not connected to how processes are actually managed.
An auditor may find that significant operational risks have been identified, but there is little evidence that appropriate controls have been established or maintained.
How to address it:
Review whether identified risks are reflected in actual process controls, monitoring activities, responsibilities, and objectives.
Risk assessments should not sit separately from the QMS. When risks change, relevant processes and controls should be reviewed as well.
8. Environmental Aspects and Compliance Obligations Are Not Adequately Controlled
For ISO 14001, findings can occur when significant environmental aspects are not properly identified, controlled, or monitored, or when applicable environmental requirements are not adequately tracked.
How to address it: Keep environmental aspects, controls, and compliance obligations up to date and review them when processes or activities change.
9. OH&S Hazards Are Not Adequately Controlled
ISO 45001 audits may identify gaps in hazard identification, risk assessment, or the controls used to protect workers.
How to address it: Review workplace hazards regularly, maintain appropriate controls, and involve workers in identifying and addressing safety risks.
10. Emergency Preparedness Is Not Adequately Maintained
Emergency procedures may exist on paper but lack evidence of testing, communication, or updates when circumstances change.
How to address it: Keep emergency plans current, ensure relevant people know their responsibilities, and periodically test the response arrangements.
11. Supplier and External Provider Controls Are Inconsistent
Organizations can have strong internal processes while having weak controls over externally provided products and services.
Common findings include incomplete supplier evaluations, outdated approved supplier lists, unclear criteria for supplier monitoring, or insufficient evidence of supplier performance.
How to address it:
Define how suppliers are evaluated, selected, monitored, and re-evaluated based on the organization’s requirements.
Keep evidence demonstrating that these controls are being applied. Where supplier performance creates repeated problems, the issue should feed into corrective action and supplier management rather than being treated as an isolated incident.
12. Required Records or Objective Evidence Are Missing
A process may be working correctly, but if required evidence cannot be demonstrated, the organization may still face a nonconformity.
For example, employees may say that inspections are performed, but the corresponding inspection records are incomplete or unavailable.
What an auditor may ask for:
- Inspection or test records
- Calibration or monitoring records
- Audit results
- Management review records
- Competence records
- Nonconformity and corrective action records
- Evidence of process performance
How to address it:
Determine whether the activity itself was performed and whether the problem is with the process or the evidence.
Then identify why records were not created, retained, controlled, or retrievable. Improving the record-keeping process may be necessary rather than simply recreating missing records.
13. Incomplete Design and Development Records
Design work can be completed successfully, but an audit may still uncover gaps in the evidence behind it. Common examples include missing design review records, verification or validation results, approval records, or documentation of design changes.
How to address it: Make sure required design records are created as the work progresses and remain traceable to the relevant project or product. When a record is missing, look beyond recreating the document. Check whether unclear responsibilities, weak change control, or an inconsistent design process caused the gap.
14. Previous Nonconformities Are Closed Without Proving Effectiveness
Closing an NCR because an action was completed can create a recurring problem.
For example, an organization may replace a defective component, update a form, or retrain an employee and immediately mark the corrective action complete. But what evidence shows that the underlying problem will not happen again?
How to address it:
Define an effectiveness check appropriate to the nature of the nonconformity.
This might involve reviewing subsequent audit results, monitoring defect trends, sampling records, observing the process, or reviewing performance data.
The question is simple:
Did the corrective action eliminate or reduce the cause of the problem sufficiently to prevent recurrence?
If the evidence says no, the NCR should not simply be closed because the assigned task was marked complete.
How to Address an ISO Audit Nonconformity
When an auditor raises an NCR, avoid jumping straight to a quick fix.
A practical response follows this sequence:
- Identify the requirement: Determine exactly which requirement was not fulfilled.
- Correct the immediate issue: Contain or correct the problem where necessary.
- Analyze the cause: Determine why the nonconformity occurred and whether the same issue exists elsewhere.
- Define corrective action: Address the cause rather than only treating the symptom.
- Implement the action: Document what was changed and retain appropriate evidence.
- Verify effectiveness: Check whether the action actually prevented recurrence.
- Close the NCR with evidence: The record should demonstrate what happened, what was done, and how effectiveness was established.
This distinction is important. An effective corrective action is intended to prevent recurrence, not simply make the original finding disappear.
Why Nonconformities Often Repeat
Recurring nonconformities are rarely solved by adding another instruction or reminding employees to “be more careful”.
The deeper problem is often a disconnected QMS.
A typical cycle might look like this:
Outdated procedure → inconsistent process → internal audit misses the gap → external audit raises an NCR → quick correction → issue returns
Breaking that cycle requires related quality processes to work together.
Document control needs to connect with process changes. Internal audits need to identify weaknesses. NCRs need to lead to meaningful corrective actions. Corrective actions need effectiveness checks. Management needs visibility into recurring issues and trends.
When these activities operate as separate spreadsheets, files, and email threads, it becomes harder to see the relationship between individual findings and wider system problems.
How Can QMS Software Help Prevent Recurring Nonconformities?
QMS Software can help bring these activities into a more connected workflow.
With QISS QMS, organizations can manage key quality processes including document control, audits, nonconformances, CAPA, supplier quality, and related quality workflows in one system.
Instead of treating an NCR as a standalone record, teams can connect the finding to corrective action, assign responsibility, monitor progress, and maintain the evidence needed to demonstrate what was done.
This creates a clearer quality improvement cycle:
Audit → Finding → NCR → Root Cause → Corrective Action → Effectiveness → Improvement → Future Audit
The goal is not simply to close more NCRs. It is to make recurring problems easier to identify, corrective actions easier to manage, and audit evidence easier to maintain.
Keep Nonconformities From Becoming Recurring Problems
An ISO audit nonconformity is a finding, not the end of the process.
The immediate issue needs to be corrected, but the bigger question is why it happened and whether the corrective action actually worked.
When organizations treat NCRs as opportunities to understand and strengthen their processes, audit findings can become useful inputs for continual improvement rather than recurring problems on the next audit.
Want to see how QISS QMS can connect audits, NCRs, corrective actions, and other quality workflows? Request a free demo.
