How to Close an ISO Audit Nonconformity with Objective Evidence

Finding a nonconformity during an ISO audit does not automatically mean that an organization cannot achieve or maintain certification. What matters is how the organization responds to the finding and demonstrates that appropriate action has been taken.

A strong response should not simply say that an issue has been corrected. The organization needs to show what was corrected, why the problem occurred, what action was taken to prevent recurrence, and what evidence demonstrates that the action has been implemented effectively.

This is where objective evidence becomes important.

What Is an ISO Audit Nonconformity?

An ISO audit nonconformity means that a specified requirement has not been fulfilled.

During an audit, the auditor may identify a gap between:

• An applicable ISO requirement and actual practice
• The organization's own documented process and what is happening
• A planned arrangement and the evidence available
• A required process and the records demonstrating its implementation

The finding should be supported by audit evidence and linked to the applicable requirement. A nonconformity is therefore not simply an auditor's opinion. It should be based on evidence collected during the audit.

What Is Objective Evidence?

Objective evidence is information that can be verified. Depending on the organization and the standard, this may include:

• Records
• Completed forms
• Audit reports
• Training records
• Inspection results
• Monitoring results
• Meeting records
• Approved procedures
• Corrected documents
• Photographs where appropriate
• System records
• Emails or other controlled records
• Evidence from interviews or observations

The important point is that the evidence should demonstrate that the required action actually happened.

For example, saying:

"Employees were retrained." is weaker than providing a completed training record, the revised training material, attendance evidence and an appropriate method for demonstrating that the required understanding or competence was addressed.

Correction vs Corrective Action

One of the most common mistakes is treating correction and corrective action as the same thing.

ISO auditing guidance explains that auditors reviewing a response should consider evidence relating to correction, cause analysis and corrective action, where applicable. It also emphasizes evidence that corrective action has been implemented and is effective.

Step 1: Understand the Nonconformity

Before taking action, make sure the finding is clearly understood.

Look at:

• The requirement involved
• The audit evidence
• The process affected
• The location or department involved
• The records referenced by the auditor
• The exact statement of nonconformity

Do not immediately jump to a solution. First understand what actually failed. For example, if an auditor identifies that equipment inspection records were not maintained as required, simply creating a new inspection form may not address the underlying problem.

Step 2: Correct the Immediate Problem

The first action is usually to deal with the immediate issue.

For example:

• Complete missing records where this is appropriate
• Correct an incorrect document
• Repair or replace defective equipment
• Update an outdated controlled document
• Provide required training
• Correct an incorrectly identified item

This is the correction. However, correction alone may not be enough.

Step 3: Identify the Cause

Next, determine why the nonconformity occurred.

Ask questions such as:

• Why did the problem happen?
• Why was it not detected earlier?
• Was the procedure unclear?
• Was responsibility unclear?
• Was training inadequate?
• Was monitoring ineffective?
• Was the process not being followed?
• Was there a resource problem?
• Was the control itself inadequate?

Avoid stopping at an obvious explanation.

For example, "employee forgot to complete the record" may describe what happened, but it may not explain why the management system allowed the omission to occur. The cause analysis should be appropriate to the nature and seriousness of the finding.

Step 4: Take Appropriate Corrective Action

Corrective action should address the cause of the problem and help prevent recurrence.

Possible actions may include:

• Revising a process
• Clarifying responsibilities
• Improving a monitoring method
• Updating a procedure
• Providing targeted training
• Introducing an additional control
• Improving document control
• Changing the approval process
• Increasing monitoring for a defined period

The action should be practical and related to the actual cause. Avoid creating unnecessary paperwork simply to demonstrate that something was done.

Step 5: Check Whether the Action Was Effective

This is an important step. Completing an action does not automatically prove that the problem has been solved.

For example, if a company provides training after a nonconformity, the organization should consider whether the training actually addressed the problem.

Depending on the finding, effectiveness may be demonstrated through:

• Follow-up records
• Internal audit results
• Monitoring results
• New inspection records
• Process observations
• Trend analysis
• Review of repeated findings
• Evidence that the problem has not recurred

ISO auditing guidance notes that auditors may determine whether closure can be supported by documentary evidence or whether additional examination, including an on-site review, is needed depending on the nature of the finding.

What Makes Good Objective Evidence?

Good evidence should be:

Relevant

It should directly relate to the nonconformity and action taken.

Verifiable

Another person should be able to review the evidence and understand what was done.

Current

The evidence should show that the action has actually been completed.

Complete

It should support the relevant parts of the response rather than provide unrelated documents.

Consistent

The evidence should agree with the organization's explanation of what happened.

Common Mistakes When Closing Nonconformities

Organizations sometimes submit corrective-action responses that are difficult to accept because the evidence does not fully support the response.

Common problems include:

1. Saying "corrected" without evidence

A statement alone does not demonstrate implementation.

2. Treating training as the solution to every problem

Training may be appropriate, but it should not automatically be used as the root-cause solution.

3. Fixing the symptom but not the cause

Replacing one missing record does not necessarily prevent the same problem from happening again.

4. Providing too many unrelated documents

More documents do not necessarily mean stronger evidence. Evidence should be relevant and easy to evaluate.

5. Using future dates as proof of completion

If an action is described as completed, the supporting evidence should demonstrate that it has actually been completed.

6. Not checking effectiveness

An action can be completed without solving the underlying problem.

Can a Nonconformity Be Closed Remotely?

Sometimes. The method used to review closure depends on the nature of the finding.

Some findings can be evaluated through submitted documents and records. Others may require additional verification or an on-site assessment.

The important question is not whether closure is remote or on-site. The important question is whether there is enough objective evidence to demonstrate that the required action has been appropriately implemented and, where necessary, is effective.

What Happens After Nonconformity Closure?

Once the response and supporting evidence have been reviewed, the auditor or certification process determines whether the finding can be accepted as closed. For certification audits, closure of findings forms part of the wider certification decision process. Certification is not simply granted because an audit has taken place.

NORMEIRA's certification process includes findings evaluation, submission of corrective-action evidence where required, and independent certification decision-making. Organizations should therefore treat nonconformity closure as part of the overall audit process rather than as a paperwork exercise.

How to Prepare a Strong Corrective-Action Response

A simple structure can make the response easier to review:

This structure helps keep the response clear and focused.

Final Takeaway

Closing an ISO audit nonconformity is not about producing the largest number of documents. It is about demonstrating a logical chain:

Finding → Correction → Cause → Corrective Action → Evidence → Effectiveness

When the evidence clearly supports this chain, the auditor can evaluate the response more effectively. A good corrective-action response should therefore be clear, relevant, evidence-based and connected to the actual cause of the nonconformity.

Frequently Asked Questions

Does every nonconformity require corrective action?

The response depends on the nature of the finding and applicable certification requirements. The organization should evaluate the correction, cause and need for corrective action appropriately.

Is training enough to close an ISO nonconformity?

Not necessarily. Training may be part of the response, but the organization should consider why the problem occurred and whether the action prevents recurrence.

What is objective evidence in an ISO audit?

Objective evidence is verifiable information used to support an audit conclusion. It can include records, documents, observations, interviews and other relevant evidence.

Can an ISO nonconformity be closed without another site visit?

Some findings can be reviewed using submitted evidence, while others may require additional verification. The approach depends on the nature of the finding.

Does a nonconformity mean certification will be refused?

Not automatically. The outcome depends on the type and status of the findings and the applicable certification process.