The most common ISO 27001 audit findings are a required activity not done at all, such as a management review, a defined process not followed in practice, several minor issues in one area, and a past minor finding left unfixed past its deadline. Risk assessment, internal audit and corrective action are frequent trouble spots.
What counts as a finding?
An audit finding, called a nonconformity, is non-fulfillment of a requirement. The requirement can come from the standard, from your own documentation, or from a third party such as a customer contract. Certification bodies grade them as major or minor.
A major nonconformity is serious enough to prevent certification until fixed. A minor one is any nonconformity that is not major, for example backups missed on a single day of a month.
Which patterns turn minor into major?
Based on how practitioners describe auditor grading, four patterns recur.
A requirement skipped entirely. The standard requires a management review. If none was held, that is not a small gap. It is a missing required element.
A process that exists on paper only. Your procedure says daily backups, and the logs show a few random days in the month. The process has broken down. The same applies to a risk assessment that was written once and never used.
Many small issues in one place. Several minor findings tied to the same process or department signal a systemic problem and can be treated as a major. Security awareness training is a typical example: a policy that requires training, with certificates missing for many people.
Old minor findings left open. A minor finding from the last audit that was not corrected within the deadline can be raised to major.
A fifth item sometimes appears: misusing the certification mark, for example claiming a product is certified. ISO management system certification covers processes, not products.
Where do the findings cluster?
Practitioner sources point to risk assessment, access control, internal audit, management review, documentation that is out of date, and corrective action follow through. These are the places where the paperwork and the practice drift apart over a year.
Notice what is missing from that list: exotic technical gaps. Most findings are about discipline, not tools.
What does auditor expectation look like for corrective action?
Fixing the immediate problem is not enough. Auditors expect a root cause analysis, a corrective action that prevents recurrence, and evidence that it worked. A finding closed with "reminded the team" invites a repeat.
Where does software supply chain evidence fit?
Annex A of the 2022 edition covers areas such as asset management, vulnerability management and secure development. If your scope includes software you build or run, an auditor may sample how you know what components you use and what you did about known flaws. A dated inventory and scan history is far easier to defend than a recollection. That is evidence for a control, and it does not certify anything by itself; only an accredited body can certify you.
What should you do before the audit?
Run your own internal audit on a schedule that actually happens, and treat its findings as real. Review the last audit report line by line and prove each item closed. Hold the management review early enough to act on what it says. Then sample your own evidence the way an auditor would: pick three random weeks and check each recurring control.
What to do
- List every open finding from your last audit and close or document it.
- Schedule the internal audit and the management review with dates in the calendar.
- Sample three random periods for each recurring control and fix gaps.
- Check training, access review and backup records for completeness.
- For each corrective action, write the root cause and the proof that it worked.
- Make sure nobody describes your status as certified until the body issues the certificate.
Quick check
Does one major nonconformity fail the audit?
According to the practitioner sources we read, a major nonconformity prevents certification until it is corrected and verified. Your certification body sets the exact process.
Can minor findings add up?
Yes. Several minor findings on the same clause or process can be treated as a major one.
Sources
- Advisera, Major vs. minor nonconformities in the certification audit, fetched 18 October 2026.
- Secfix, Top ISO 27001 nonconformities, fetched 18 October 2026.
Last reviewed: 18 October 2026.
