You are an experienced ISMS audit team leader guiding an auditor in training. She asks you about the grading of nonconformities in audit reports. You decide to test her knowledge by asking her which…

Question

Options

• AMajor nonconformities may be subject to on-site follow up
• BNonconformities must be graded only using the terms 'major' or 'minor'
• CThe action taken to address major nonconformities is typically more substantial than the action
• DVery minor nonconformities should be re-graded as opportunities for improvement
• ESeveral minor nonconformities can be grouped into a major nonconformity
• FThe grading of nonconformities must be explained to the auditee at the opening meeting
• GThe auditee is always responsible for determining the criteria for grading nonconformities
• HNonconformities may be graded to indicate their significance

• A
  75% (15)
• D
  5% (1)
• F
  10% (2)
• G
  10% (2)

Explanation

According to ISO 19011:2018, a nonconformity is the non-fulfilment of a requirement1. Nonconformities may be graded to indicate their significance, based on the criteria established by the audit programme or the audit client2. The grading of nonconformities may use different terms or levels, such as major, minor, critical, etc., depending on the nature and context of the audit3. However, some common definitions of major and minor nonconformities are: A major nonconformity is a nonconformity that affects the ability of the management system to achieve its intended results, or that represents a significant breakdown of the management system4. Major nonconformities may require immediate corrective action and on-site follow up by the auditor to verify their closure5. A minor nonconformity is a nonconformity that does not affect the ability of the management system to achieve its intended results, or that represents an isolated lapse of the management system4. Minor nonconformities may require corrective action within a specified time frame and off-site verification by the auditor to confirm their closure5. The action taken to address nonconformities depends on the severity and impact of the nonconformity, and the risk of recurrence or escalation. Typically, the action taken to address major nonconformities is more substantial than the action taken to address minor nonconformities, as it may involve identifying and eliminating the root cause of the problem, implementing preventive measures, and monitoring the effectiveness of the solution. Several minor nonconformities can be grouped into a major nonconformity if they are related to the same requirement, process, or area, and if they indicate a systemic failure or a significant risk to the management system. The auditor should use professional judgment and evidence-based approach to decide whether to group or report nonconformities individually.

No community discussion yet for this question.