By Russell Lawson, ISO consultant, lead auditor, and founder of The Compliance Companion - the AI-powered platform that helps businesses implement ISO 9001, ISO 14001, ISO 45001 and ISO 27001 through real-world templates, expert guidance and scalable systems. Russell has supported hundreds of businesses across the UK to build ISO systems that work in practice, not just on paper - and he’s seen first-hand what separates organisations that just pass audits from those that actually improve.
In the world of ISO, few words cause more anxiety than nonconformity.
I’ve worked with plenty of organisations that go into panic mode the moment one is raised - whether during an internal audit, a surveillance visit, or day-to-day operations. People worry it will reflect badly on their work, damage their reputation, or trigger a flood of paperwork.
But here’s the thing: nonconformities aren’t bad. In fact, handled properly, they’re one of the most powerful tools your management system has for driving real improvement.
In this blog, I’ll explain what ISO standards actually expect when it comes to nonconformities, what I’ve seen go wrong, and how the best-performing businesses I work with use them as a strategic advantage.
What Does ISO Actually Mean by “Nonconformity”?
A nonconformity is simply this:
Something that doesn’t meet a stated requirement.
That might be:
-
A product or service that didn’t meet the specification
-
An audit finding that reveals a process gap
The key point is that nonconformities are deviations from what you said you’d do - or what you’re required to do.
And every ISO standard expects you to find, correct, and learn from them:
-
ISO 9001 (Clause 10.2) - Nonconformity and corrective action
-
ISO 14001 (Clause 10.2) - Focused on environmental performance
-
ISO 45001 (Clause 10.2) - With specific attention to health & safety incidents
-
ISO 27001 (Clause 10.1) - Around information security failures
What I See Going Wrong (Even in Certified Organisations)
I’ve seen many businesses treat nonconformities as something to hide or minimise. Here are a few examples that have come up in real audits:
“We haven’t had any nonconformities all year”
That’s not always a good thing. In most cases, it means issues are either being ignored, disguised as something else, or not being logged at all.
“The training matrix was out of date, so we just updated it.”
Great - but that’s a correction, not a corrective action. You’ve fixed the symptom, but not the root cause.
“We forgot to do the calibration - we’ll make sure it gets done next week.”
And what’s stopping it being forgotten again next month?
“It was the contractor’s fault.”
That may be true - but if they work under your control, it’s still your system. The ISO standard doesn’t allow for passing the blame.
The issue in all of these cases is the same: nonconformities are seen as short-term problems to fix - not long-term lessons to learn from.
What Smart Businesses Do Instead
The organisations I’ve seen thrive under ISO don’t panic when nonconformities happen. They welcome them. Why? Because they know each one is a window into how their system can be improved.
Here’s the approach I’ve helped many of my clients adopt - and that I’ve seen work time and again:
Log every issue - big or small
From audit findings to customer complaints to missed inspections, capture it all. This doesn’t mean drowning in forms - just make it easy to report and track.
Separate correction from corrective action
Fix the immediate problem, sure - but always ask “why did it happen?” and “how can we stop it happening again?”
Use root cause analysis - but keep it simple
Tools like the 5 Whys or Fishbone Diagrams can help, but don’t get hung up on formality. Focus on the thinking, not the format.
Assign actions, deadlines and follow-up
Don’t just note down a root cause and move on. Build in a review - check whether the action worked, and whether the issue has stayed fixed.
Share learning across the business
One department’s mistake could be another’s hidden risk. Turn nonconformities into case studies that help everyone get better.
A Real Example: From Repetition to Resolution
I worked with a manufacturing client who had repeated issues with packing errors. Every time it happened, someone would get retrained, or a label would be moved - but nothing changed.
When we finally looked deeper, the root cause was clear: there was no final check built into the process, and the packing area was under-staffed at peak times.
The solution?
-
A double-check step before despatch
-
A staffing rota based on actual order volumes
-
A redesigned layout that made it easier to spot errors early
Result?
✔️ Packing errors dropped by 80%
✔️ Complaints fell
✔️ Staff were more confident - and less frustrated
All from taking one recurring nonconformity seriously and using it as a signal for system-level change.
Your ISO System Needs to Learn From Itself
This is what Clause 10.2 is really about. Not blame. Not form-filling. Not appeasing auditors.
It’s about building a management system that can:
-
Spot when something isn’t working
-
Understand why it happened
-
And make changes that actually stick
That’s what real improvement looks like - and it’s why nonconformities are one of the most underused resources in ISO systems today.
Want to Get This Right Without Overcomplicating It?
Inside The Compliance Companion, you’ll find:
-
A smart, ready-to-use nonconformity log
-
Root cause prompts and action tracking tools
-
Example entries to guide you
-
Embedded AI suggestions to help write actions and track effectiveness
It’s designed to help you turn nonconformities into improvements - with minimal admin and maximum clarity.
👉 Explore it here: https://the-compliance-companion.co.uk/harness-the-future-of-iso