ISO 9001 clause 9.2 internal audit nonconformity: what can a certification auditor actually cite?

Practitioners on Reddit keep returning to one disagreement: when does something found in an ISO 9001 internal audit become a nonconformity, and when is it only an observation? We follow these discussions to see what practitioners are asking and to add to the conversation. This piece gives UK quality teams a clear test for each finding a certification auditor can raise and shows how clause 9.2 shapes it. It also covers the point practitioners argue about most: internal audits that only check paperwork.

A nonconformity is the non-fulfilment of a requirement. A certification auditor can cite one only when a specific requirement and specific objective evidence are both on record.

The five findings a UKAS-accredited certification body can raise

UKAS accredits certification bodies in the UK against ISO/IEC 17021-1, the standard that governs how they audit management systems. Bodies word their findings differently. This piece uses five: major nonconformity, minor nonconformity, observation, opportunity for improvement and positive finding. The first two are nonconformities. The other three are not, and they do not affect certification.

Major nonconformity: the system cannot deliver its intended results

ISO/IEC 17021-1 treats a nonconformity as major when it affects the capability of the management system to achieve its intended results. Under clause 9.2, the clearest route is the absence of the process itself. If no internal audit has taken place within the planned intervals, or the audit programme leaves out whole processes, the organisation has no way to establish whether the system conforms and is effectively implemented. That is the stated purpose of clause 9.2.1.

A cluster of minor nonconformities against the same requirement can also show a systemic failure, and the certification body may grade it as major. A major nonconformity can stop a certification decision until corrective action is verified and can put an existing certificate at risk of suspension.

Minor nonconformity: a lapse that leaves the system capable

A minor nonconformity is a failure to fulfil a requirement that does not affect the system's capability to achieve its intended results. Each example needs a requirement and evidence. A machining firm's programme schedules a supplier audit for March and the records show none by the surveillance visit (clause 9.2.2 a and f). An auditor was assigned to their own department, which breaches objectivity and impartiality (clause 9.2.2 c). A finding was raised but no correction or cause analysis was recorded (clauses 9.2.2 e and 10.2.1).

The requirement can come from ISO 9001 or from the organisation's own documented procedures. Clause 9.2.1 asks whether the system conforms to the organisation's own requirements as well as to the standard.

Observation, opportunity for improvement and positive finding: what stays below a nonconformity

An observation records a weak point where the evidence does not yet show a requirement has been missed. Audit checklists that restate clause wording without recording what was sampled are one example. An opportunity for improvement is a suggestion that goes beyond the requirement, such as setting audit frequency by process risk when the current schedule already meets clause 9.2.2 a. A positive finding records something working well, although not every certification body issues them.

None of these needs formal corrective action under clause 10.2, because none records non-fulfilment of a requirement. The test is the same each time. If the auditor cannot name the requirement and the evidence, the finding stays out of the nonconformity category.

How clause 9.2 patterns turn into findings and what closes them

These five patterns account for much of what a certification auditor can cite against internal audit arrangements. Each row pairs the pattern with the record that closes it.

What the auditor finds	What closes the gap	What the practitioner gains
The audit programme lists every process, but records show some were never audited	Plan the programme by process importance, changes and past results, then tick off each audit against it	A dated record that answers the auditor's first question under clause 9.2.2
Findings were raised but there is no correction, cause or closure record	Log each finding with an owner, a due date, a root cause and a check that the action worked	A traceable path from finding to closure under clauses 9.2.2 and 10.2
Reports conclude that the process conforms but record no sample, interview or observation	Record what was sampled, who was interviewed and what was observed on the shop floor or in the office	Evidence that the system is implemented, not only documented
An auditor assessed their own department	Assign auditors from outside the area under audit	Objectivity and impartiality that can be shown on request
The same finding recurs across consecutive audits	Link each repeat to the earlier record and reopen the root cause	Less risk of minor findings being grouped into a major one

What objective evidence an auditor will ask to see for clause 9.2

Objective evidence is data that supports the existence or truth of something. For clause 9.2, an auditor will ask for:

• The audit programme, with frequencies, methods, responsibilities and the reasons behind them
• Audit plans showing the criteria and scope of each audit
• Records of who audited which process and why they were objective and impartial
• Completed audit reports showing what was sampled, observed and discussed
• Findings with correction and corrective action records, including root cause and effectiveness checks
• Management review minutes showing audit results as an input (clause 9.3.2)

Each item maps to a part of clause 9.2.2, so a gap points the auditor straight to a requirement. Before initial certification, the certification body also needs to see that internal audits and a management review have been carried out, so these records matter from the first audit cycle.

Is an internal audit that only checks paperwork a nonconformity?

Practitioners and certification auditors disagree on this, and the disagreement is reasonable because the standard does not settle it directly.

One position rests on clause 9.2.1 b, which requires the audit to show whether the system is effectively implemented and maintained. A document review shows that a procedure exists. It cannot show that people follow it. Where reports rest on document review alone and the certification auditor finds the process running differently on the shop floor, the gap between the two can be cited against clause 9.2.1.

The other position is that ISO 9001 does not prescribe audit methods or sample sizes. Clause 9.2.2 a leaves methods to the organisation's audit programme. On this view a narrow method is a weakness, not a missed requirement, so it is recorded as an observation or an opportunity for improvement. ISO 19011:2018 describes gathering information through interviews, observation and document review, but it is guidance, not a requirement that a certification body audits against.

The two positions meet at the evidence. A method alone is hard to cite. A method that produced a clean internal report, followed by a certification audit that finds a nonconformity in the same process within the same period, gives the auditor both a requirement and objective evidence. The first stays an observation. The second can become a nonconformity.

What makes an internal audit credible to a certification auditor

Credibility comes from an audit being capable of finding something. Three signs stand out: scope and criteria defined before the audit starts, sampled records tied to named processes, and findings the organisation raised against itself rather than ones the certification auditor discovered first. An audit programme with no findings across a full cycle gives the auditor little evidence that the audits could detect anything.

For the wider approach to QMS audits, including how nonconformities and corrective actions are followed up, see this guide to auditing your audits as part of a quality management system audit.

What to look for in audit finding management software for UK enterprises

Audit finding management software records each finding from the point it is raised to verified closure. For clause 9.2, the software should let the user record the requirement and the objective evidence against every finding, because those two fields decide whether it is a nonconformity. It should classify findings as major, minor, observation or opportunity for improvement without forcing everything into one category.

Corrective actions need an owner, a due date, a root cause and an effectiveness check. Repeat findings across audit cycles should surface without manual searching. The audit programme and its records should export cleanly for a certification audit, with a full trail of who changed what and when. UK enterprises with data residency requirements should also confirm where the data is hosted.

Cite the requirement, cite the evidence or record an observation

A finding under clause 9.2 is citable when a named requirement and objective evidence line up. Major nonconformities concern a system that cannot deliver. Minor ones concern a lapse. Observations, opportunities for improvement and positive findings cannot be cited as non-fulfilment. Paperwork-only audits sit on the line, and the evidence from the certification audit decides which side they fall on. Teams that record the requirement, the evidence and the closure for every internal finding are ready for either outcome.

Readers who want to continue the discussion can join practitioners in Ideagen's Reddit community.