By Russell Lawson, ISO consultant and founder of The Compliance Companion. Russell has helped hundreds of businesses implement and improve ISO 9001, ISO 14001, ISO 45001 and ISO 27001 systems across a wide range of industries. He also owns The Ideas Distillery, an ISO consultancy company helping businesses achieve certification without unnecessary complexity.
If there’s one word that tends to make people nervous in the world of ISO audits, it’s nonconformity.
But over the years, I’ve found that the smartest businesses - the ones that don’t just get certified, but actually improve - treat nonconformities not as problems, but as opportunities.
Unfortunately, far too many organisations still view them as a nuisance. Something to explain away. Something to fix just enough to get the auditor off their back. And then they move on.
That’s a huge missed opportunity. Because nonconformities, handled correctly, are one of the most powerful tools for improvement any ISO system offers.
Why Nonconformities Are Good News (Really)
Let’s get something straight: identifying a nonconformity is a sign your management system is working.
It means:
- You have controls in place that actually detect when things go wrong
- You have mechanisms to investigate the root cause
- You’re committed to doing something about it
That’s not a weakness. That’s maturity.
In fact, one of the things I often point out to clients during internal audits or surveillance reviews is that a lack of nonconformities over a long period usually suggests one of two things:
- You’re not looking hard enough, or
- You’re not being honest with yourselves
No business is perfect. And no process works flawlessly forever. The whole point of a management system is to help you catch problems before they escalate - and improve your systems in the process.
Where Most Businesses Go Wrong
One of the most common patterns I’ve seen over the years is businesses treating nonconformities like a “paper exercise.”
They fix the immediate issue (“John didn’t follow the checklist”) but don’t investigate the why. Was the checklist hard to find? Did John even know it existed? Has the process drifted over time?
When you treat a nonconformity like a surface-level defect, all you get is a surface-level fix. And the same issue will likely happen again.
But when you see nonconformities as a signal of deeper systemic weaknesses, you unlock real opportunities for change.
A Smarter Approach to Handling Nonconformities
Here’s the process I encourage clients to adopt - one that’s worked across countless ISO 9001, 14001, and 45001 systems I’ve helped implement or audit:
1. Stop looking for someone to blame
Nonconformities are usually system failures, not people failures. Focus on the process.
2. Go beyond the symptom
Ask “why?” until you get to the root cause. The 5 Whys technique works well here.
3. Fix the system, not just the situation
Change the process, improve the training, update the documentation - whatever it takes to stop it happening again.
4. Track effectiveness
Did the corrective action work? Build in a review so you can check back after 30 or 60 days.
5. Share the learning
If one department had the issue, chances are others could too. Turn isolated incidents into wider improvements.
I’ve seen this approach turn a struggling system into a model of continual improvement. And I’ve seen businesses who once dreaded audits start welcoming them - because they see them as a chance to get better.
Where ISO Standards Back You Up
All the major ISO standards are built on this mindset:
ISO 9001 puts continual improvement at the heart of the system (Clause 10). Nonconformity + corrective action = a chance to get better.
ISO 14001 expects you to correct problems in your environmental performance - and stop them recurring.
ISO 45001 treats nonconformities not just as compliance issues but potential threats to worker safety.
It’s not about fixing isolated incidents. It’s about building a learning organisation - one that evolves with every insight.
How I See the Best Companies Handle It
Some of the most successful businesses I’ve worked with have flipped their thinking entirely.
They actually look forward to uncovering nonconformities - because they know that every issue they find and fix is a step forward.
They’ve built cultures where staff aren’t afraid to speak up, where problems are logged without fear, and where improvement is part of everyday thinking.
Those businesses don’t just pass audits. They build systems that make them better, leaner, and more resilient.
Want to make your system smarter, not harder?
The Compliance Companion is designed for exactly this - helping businesses simplify ISO compliance without losing what matters. It gives you ready-made templates, smarter prompts, and real-world examples to help you handle nonconformities properly - and turn them into a true source of improvement.
If you’d like to see how it works – and how it can help you build smarter supplier management – take a look here:
👉 https://the-compliance-companion.co.uk/harness-the-future-of-iso