Handling Nonconformities Raised During Stage 2
A non-conformity raised during Stage 2 is a serious finding. It indicates that a control you claimed was operating is either not in place, not operating effectively or not addressing the risk it is supposed to manage. Non-conformities are classified as major or minor. A major non-conformity indicates a systemic failure (e.g., a control is completely absent or is not operating). A minor non-conformity indicates an isolated failure or partial non-compliance (e.g., a control operates most of the time but an instance of non-compliance was found).
The certification body’s policy determines how many major or minor non-conformities can be present for certification to be granted. Typically, zero major non-conformities are required for certification. Minor non-conformities can sometimes be accepted provided a corrective action plan is in place to close them within 30 to 90 days. Some bodies allow certification with minor findings open, others require all findings to be closed. You should clarify this with your auditor before Stage 2 begins.
When an auditor raises a non-conformity during Stage 2, they will explain what they found, why it is a non-conformity and whether they consider it major or minor. This explanation happens in real time so that you can ask clarifying questions and understand the auditor’s reasoning.
Some Stage 2 non-conformities are straightforward. For example, if your procedure says you conduct quarterly risk assessments and the auditor found that only one assessment occurred in the past year, that is a clear minor non-conformity. Other non-conformities are more nuanced. For example, if the auditor found that your risk assessment methodology does not adequately address certain types of impacts (e.g., impacts on vulnerable populations), that is a non-conformity, but your organisation might dispute whether the impact truly matters or whether your methodology actually failed to address it. In these cases, you may request an opportunity to meet with the auditor after Stage 2 to discuss the finding.
Preparing Corrective Action Plans
After Stage 2 closes, you will have a specified timeframe (typically 30 to 90 days) to submit corrective action plans for any non-conformities. A corrective action plan should explain the root cause of the non-conformity, the corrective action you will take and the evidence you will provide to demonstrate closure.
Understanding the root cause is essential. If the non-conformity is “Incident response procedures were not followed in three out of five incidents sampled,” the root cause might be that staff were unaware of the procedures, that the procedures were unclear, that time pressure prevented following them or that the procedures were impractical. The root cause matters because it determines what corrective action is appropriate. If staff were unaware, your corrective action is training. If procedures were unclear, your corrective action is clarification. If procedures were impractical, your corrective action might be redesigning the procedure.
In your corrective action plan, be specific about who will do what by when. For example, instead of stating “We will improve our risk assessment methodology”, state “The risk team, led by [person], will revise the risk assessment methodology by [date] to include an explicit section on impacts to vulnerable populations. We will pilot the revised methodology on two existing systems and provide evidence of the pilot by [date].”
After you take corrective actions, you will provide evidence to the auditor. The auditor will review your evidence to determine whether you have genuinely closed the non-conformity. This review is usually done remotely without requiring an audit visit. However, if you have closed multiple major non-conformities or if your evidence is unconvincing, the auditor may require a follow-up visit to verify closure.
Non-conformities raised during Stage 2 can delay certification. If you have non-conformities that take 90 days to close and you hoped to have a certificate within 60 days of your Stage 2 audit, adjust your expectations. Plan for the corrective action timeline when you schedule your Stage 2 audit.
The auditor will provide clear guidance on the severity of each finding, which helps you prioritise your corrective action efforts. Major findings require more substantial investigation and remediation, while minor findings can often be closed with targeted fixes. Understanding the auditor’s reasoning for their classification helps you plan realistic timelines and allocate resources appropriately. If you disagree with the severity of a finding, ask the auditor to explain their reasoning in detail.