The auditor's closing meeting is supposed to be ceremonial: thank you for your cooperation, here are our findings, we will send the formal report in a few days, and congratulations on your certification. But in some cases, the auditor says something different: "We have a major nonconformity that must be resolved before we can issue the certificate." The room falls silent. You prepared for minor findings; you did not prepare for this. The fear is immediate: does a major nonconformity mean you will not be certified? The answer is more nuanced. A major nonconformity is serious, but it does not automatically mean denial of certification. It means you have a compressed timeline and a very specific task.
A major nonconformity is an absence or a systematic failure in a critical area of the quality management system. Examples include the absence of documented nonconformance handling, evidence that multiple major process controls are not in place, a failure in supplier management that resulted in conformance issues, or a gap in management review that suggests the leadership is not actually overseeing the system. Major nonconformities are distinguished from minor nonconformities (also called observations) by scope and severity. A missing record or a single procedural lapse is usually a minor finding. A finding that affects an entire process or suggests that the system as documented is not functioning is a major finding.
Immediate Actions and the Response Timeline
When you receive a major nonconformity, you typically have 30 days to respond with a corrective action plan and evidence of initial implementation. The timeline is short by design; certification bodies want to see that you take the finding seriously and that you move quickly. Your immediate action is to get the auditor's formal report (it should arrive within a few days of the audit), read it carefully, and understand the exact nature of the finding. The finding report is not emotional; it is specific. It states what was missing or what was observed to be noncompliant, with reference to the standard and supporting evidence. If the finding says "procedures for handling nonconformances are not documented," you now know exactly what is missing. If it says "nonconformance records exist but show no evidence of investigation or corrective action on five of eight recent records," you know the scope of the problem.
Your corrective action plan should address the root cause, not just the symptom. If procedures are missing, the action is to write and approve them and to train the team on them. If procedures exist but are not followed, the action is to understand why (lack of awareness, perceived impracticality, competing pressures) and address the barrier. If nonconformances are recorded but not investigated, the action is to establish a nonconformance investigation template, train the team on when and how to use it, and ensure that new nonconformances are handled correctly going forward. Additionally, you should retroactively review any nonconformances that were originally handled without proper investigation and supplement the records with the missing analysis and corrective action.
Communication with the Certification Body
Most certification bodies are pragmatic about major nonconformities during the initial certification audit. They expect that a new system will have gaps. What they want to see is genuine corrective action, not window dressing. When you submit your corrective action plan, be honest and specific. State the root cause, describe the action you are taking, assign responsibility, and give dates. If the root cause is that procedures were not documented, say so. If the root cause is that you understood a requirement differently than the auditor does, say so and explain your reasoning before accepting the auditor's interpretation. If the root cause is that you did not realize a procedure was necessary, that is also acceptable; the action is to establish it now.
The certification body will review your corrective action plan and either accept it or ask for clarification. If accepted, they will want evidence that the action has been implemented. This typically means submitting copies of the new or revised procedures, training records showing that the team has been trained, and records (nonconformances, inspections, meetings) demonstrating that the new process is working. If the major nonconformity was about traceability, the evidence might be a revised work order form with traceability fields, proof that an operator has filled out the new form, and a trace-back exercise showing that a part can be traced from its origin to its final destination. All of this should be submitted within the 30-day window.
Surveillance Audits and the Demonstration of Effectiveness
Certification is not automatic after you resolve the major nonconformity and submit evidence. Your corrective action evidence will be reviewed, and in many cases, a surveillance audit (an abbreviated follow-up audit) will be scheduled to verify that the action has been implemented and that the system is functioning. A surveillance audit typically occurs three to six months after certification and focuses on the areas that were identified as nonconformities. The auditor will ask the same questions: "Show me how you handle nonconformances. Are they being investigated? Is corrective action being assigned and tracked to closure?" If the answer is yes and the records support it, the major nonconformity is closed and the certificate stands. If the answer is no or the records are weak, the major nonconformity may be re-cited and the certificate could be suspended.
This is why implementing the corrective action genuinely matters. If you submit evidence of a new procedure but then return to your old practice, the surveillance auditor will catch it. If you modify your records to look compliant but do not actually change how you work, the auditor will discover the gap through observation and questioning. The path to maintaining your certificate is to make the corrective action real, train your team to execute it consistently, and integrate it into your normal operations before the surveillance audit occurs.
Preventing Major Nonconformities in the First Place
Major nonconformities are usually not surprises if you have prepared well. A mock audit, a critical review of your procedures against the standard, and conversations with an auditor or a consultant before the formal audit will surface major gaps. The areas most likely to generate major nonconformities in small manufacturing include the absence of documented procedures for critical processes, failures in supplier management, gaps in nonconformance and corrective action systems, and incomplete management review. If you conduct even a limited review of these areas before the audit, the likelihood of a major nonconformity drops sharply.
QMS2GO's manufacturing certification page outlines how to conduct a pre-audit self-assessment and identifies the highest-risk areas for manufacturers at different maturity levels. Using this resource to pressure-test your system before the external audit is one of the most effective ways to avoid the scenario of a major nonconformity and a compressed response timeline. That said, even with excellent preparation, major nonconformities can appear; they are not a reflection of incompetence, but rather an opportunity to strengthen your system under a manageable deadline.