A major nonconformity usually means a required element is missing or has broken down. A minor one is an isolated lapse in a system that otherwise works. Either way, you need a root cause, a fix that removes it, and proof the fix worked. Your certification body decides how it grades findings.
Grading is a certification body habit
Practitioner guidance commonly notes that the ISO 27001 standard does not require findings to be graded as major or minor. Certification bodies grade them as a matter of practice, and their rules differ. Read your certification body's procedure rather than relying on a general rule.
A commonly described pattern: a major finding can block or delay a certificate until it is closed, while a minor finding is accepted with a plan and checked at the next visit. Treat that as typical, not guaranteed.
What counts as major in practice
Examples that practitioners usually place in the major bucket are no internal audit performed, no risk assessment process, or a required control that does not exist at all. Examples of minor findings are one missed access review in an otherwise regular cycle, or one policy past its review date.
Repeating a minor finding is a risk. If the same weakness shows up again, expect it to be treated more seriously.
The five steps of a good response
Clause 10.2 guidance describes a sequence that works well as a template for every finding.
- React: contain the issue and fix the immediate problem.
- Evaluate the cause: ask why it happened, not only what happened.
- Implement corrective action: change the process, training or control so it does not recur.
- Review effectiveness: show the change worked, for example with a later sample.
- Keep records: the finding, the cause, the action and the verification.
Write the response for the reader
The auditor wants to see a cause and a change. "Reminded the team" is a weak answer. "Added an automatic ticket on the first of each month and assigned a backup owner" is a stronger one. Include the date, the owner and the evidence that the action ran at least once.
An example corrective action record
A useful record is short and complete. Finding: quarterly access review for the production database was not performed in one quarter. Immediate fix: review completed on the date it was found, with two accounts removed. Cause: the owner changed roles and the reminder stayed with their old calendar. Corrective action: the task moved to a shared ticket queue with a backup owner. Effectiveness check: the next two reviews were completed on time, with evidence attached.
Notice that the cause is about the process, not the person. Auditors read blame as a sign the real cause was not found.
Timelines
Certification bodies give you a deadline to submit your plan and evidence, and the deadline differs by finding type. Read the letter that comes with the findings and put the dates in your calendar the same day. Missing a response date is an avoidable way to delay a certificate.
Quick check
Should we argue with a finding?
If the evidence shows the auditor misread the situation, say so politely and attach the evidence. If it is a fair finding, spend your time on the corrective action instead.
Sources
Last reviewed: 19 October 2026.
