A nonconformity closes on verified evidence that its cause has been addressed. A corrective action plan on its own does not close it. A complete response has three parts: the correction that deals with what we found, the cause analysis that explains why your system allowed it, and the corrective action that changes the system so the same thing does not recur. A major nonconformity has to be corrected and the correction verified before certification can proceed. A minor is closed against a corrective action plan with root cause, and we verify it at your next audit.
Start with the finding itself, because its wording is constrained. ISO/IEC 17021-1 requires us to record a nonconformity against a specific requirement of the standard and to identify the objective evidence it rests on. A finding you receive names a clause, states what was found, and points at the evidence behind it: a document, a record, something observed, something said in an interview. Where one of the three is missing, ask for it at the closing meeting. A finding you cannot trace to a clause is one you cannot write a useful response to.
Three parts to a response
The correction is the immediate action on the nonconformity we found. The record gets completed, the expired calibration certificate gets replaced, the untrained operator gets trained. Organizations are usually fastest at this part, and on its own it leaves the finding open.
The cause analysis is the work. ISO 9001, ISO 14001 and ISO 45001 all carry it in clause 10.2: react to the nonconformity and correct it, then evaluate the need for action to eliminate the causes so that it does not recur, which includes reviewing the nonconformity, determining its causes, and determining whether similar nonconformities exist or could potentially occur. That last requirement is the one most responses skip. Where an audit found one uncalibrated gauge on one production line, the question the clause asks is how many gauges the site has, what recalls them for calibration, and why that mechanism did not reach this one.
The corrective action follows from the cause, and it has to be something a later audit can look at: a revised procedure, a change to the planning that schedules recalibration, a check added to the internal audit program. Then the evidence. A revised document with its issue date shows intent. A record generated after that date shows the change operating, and both are needed.
The response we send back most often is the one that stops at the correction. "The operator has been retrained and the record is complete" answers what happened to one record. It does not say why the system produced an unfilled record, and it does not answer the part of clause 10.2 that asks whether the same gap exists elsewhere. Where such a response is accepted, the finding tends to reappear at the next audit, and a repeat is the standard route from a minor to a major: a nonconformity the organization has already been told about and has not eliminated is no longer an isolated lapse.
While it stays open
An open nonconformity at initial certification stops the decision. The certification decision is taken independently of the audit team: an auditor recommends, and a separate reviewer decides on the file, which includes the finding, your response and our verification of it. That review sits after the audit report in the sequence set out on how certification works, which is also where the grading of findings is defined.
For an organization already certified, a nonconformity raised at a surveillance and left unresolved runs toward suspension. A suspended certificate is not in force for the period of the suspension, and the status changes in our public register while the printed document in a customer's file still reads as it did on the day it was issued. Anyone checking a certificate reads the status in the register.
One limit on what we do next. We will tell you which clause the finding was raised against, why the evidence supports it, and what would close it. We will not write your cause analysis or the procedure that comes out of it, because at the next audit we have to judge whether it worked.