The Clock Is Ticking on Your Nonconformance
You have just come out of your ISO certification audit and the auditor has raised a nonconformance. Maybe it is a major, maybe it is a minor. Either way, you have been given a deadline to close it out. Then reality sets in. The root cause is more complex than you thought, your key person just resigned, or the corrective action requires a system change that takes longer than expected. Now you are staring down a deadline you cannot meet.
On this page
This situation is far more common than most businesses realise. Missing a nonconformance closure deadline does not automatically mean the end of your certification, but it does trigger a formal process that can get uncomfortable quickly if you do not handle it correctly. Understanding exactly what happens, and what your options are, will help you navigate this without losing your certificate or damaging your relationship with your certification body.
What Is a Nonconformance and Why Does the Deadline Matter?
A nonconformance, sometimes written as NC or NCR, is a finding raised by an auditor when your management system fails to meet a requirement of the relevant ISO standard. It is not just an observation or a suggestion. It is a documented failure that must be addressed through a formal corrective action process.
When an auditor raises a nonconformance, they will typically assign it a classification. A minor nonconformance is an isolated failure that does not indicate a systemic breakdown. A major nonconformance is a more serious finding, usually indicating that a requirement is not being met at all, or that a series of minor issues points to a systemic problem. If you want to understand the difference between an observation and a nonconformance in more detail, the article on what it means when an auditor raises an observation versus a nonconformance covers that distinction clearly.
The deadline matters because your certification status is often conditional on closing the finding. For a major nonconformance raised during an initial certification audit, your certificate will not be issued until the finding is closed to the auditor's satisfaction. For findings raised during surveillance or recertification audits, the deadline is tied to your ongoing certification cycle. Miss it without communication, and you are putting your certificate at risk.
Typical Timeframes and What Certification Bodies Expect
Most accredited certification bodies work to timeframes that are guided by ISO 17021, the international standard for conformity assessment bodies. While exact timeframes vary between certification bodies, the following is a reasonable guide to what most businesses can expect.
- Minor nonconformances are typically expected to be closed within 30 to 90 days of the audit.
- Major nonconformances raised at initial or recertification audits usually require closure within 30 to 60 days, sometimes shorter, before a certificate can be issued or renewed.
- Major nonconformances raised at surveillance audits may trigger a special audit or an extended review period, with deadlines ranging from 30 to 90 days depending on the certification body's rules.
The clock starts from the date the audit report is formally issued, not from the day of the audit itself. That distinction matters because there is sometimes a gap of one to three weeks between the audit and the formal report. Always check the exact date on your audit report, not the audit date, when calculating your deadline.
What Actually Happens When You Miss the Deadline
This is the part most businesses are anxious about, and understandably so. The consequences depend heavily on three factors: the classification of the nonconformance, whether you have communicated with your certification body proactively, and your overall certification history.
For Minor Nonconformances
If you miss the deadline on a minor nonconformance without any communication, your certification body will typically follow up with a formal notice. In most cases, they will give you a short extension, often 30 days, before escalating. If you still do not respond or close the finding, the certification body may suspend your certificate. Suspension means your certification is technically inactive and you cannot legitimately claim it until the finding is closed and the suspension lifted.
For Major Nonconformances at Initial Certification
This is the most consequential scenario. If your certificate has not yet been issued and you cannot close a major nonconformance in time, you will not receive your certificate. The certification body cannot issue a certificate while a major finding remains open. In some cases, if the deadline passes without resolution, the entire certification process may need to be restarted, which means additional audit days and costs. This is a situation you absolutely want to avoid by communicating early.
For Major Nonconformances at Surveillance or Recertification
If you already hold a certificate and a major nonconformance is raised at a surveillance or recertification audit, the certification body will usually suspend your certificate if the finding is not closed by the deadline. If suspension continues beyond a defined period, typically three to six months depending on the certification body's rules, your certificate may be withdrawn entirely. Withdrawal is a much more serious outcome than suspension and means starting the certification process again from scratch.
The Right Move: Communicate Before the Deadline, Not After
The single most important thing you can do when you realise you cannot close a nonconformance in time is to contact your certification body before the deadline expires. This is not just good practice. It is the difference between a managed extension and a formal suspension.
Certification bodies are not trying to catch businesses out. They are trying to verify that your management system is genuinely conforming to the standard. If you approach them honestly with a clear explanation of why you need more time and a credible plan to close the finding, most certification bodies will work with you. What they will not tolerate is silence.
When you contact your certification body, you should be prepared to provide the following.
- A written explanation of why the original deadline cannot be met, including any circumstances that were outside your control.
- Evidence of the corrective action work completed to date, even if it is not finished.
- A revised timeline with specific milestones, not just a new end date.
- A named person who is accountable for the corrective action.
The more specific and credible your plan, the more likely the certification body is to grant an extension. Vague assurances that you are working on it will not be well received.
How to Build a Corrective Action Plan That Buys You Time
If you are struggling to close a nonconformance, the quality of your corrective action plan becomes critical. A weak plan that simply describes what went wrong and promises to fix it is not enough. A strong corrective action plan demonstrates that you have understood the root cause and are taking systematic action to address it.
Root cause analysis is where many businesses struggle. They describe the symptom rather than the cause. For example, if the nonconformance is that internal audits were not conducted on schedule, the symptom is missed audits. The root cause might be that there is no designated internal auditor, or that audit scheduling is not integrated into the business calendar, or that management has not allocated time for it. The corrective action needs to address the root cause, not just reschedule the missed audits.
If you are not sure how to structure your corrective action evidence or how long you need to keep it, the article on how long corrective action evidence needs to be kept is worth reading before you submit anything to your certification body.
A credible corrective action plan for an extension request should include the following sections.
- Description of the nonconformance in your own words, showing you understand what was found.
- Root cause analysis using a recognised method such as the five whys or a fishbone diagram.
- Immediate containment actions already taken to prevent further impact.
- Systematic corrective actions planned or in progress to address the root cause.
- Verification method describing how you will prove the corrective action is effective.
- Revised completion date with justification for the timeline.
What Happens During an Extension Period
If your certification body grants an extension, that extension is not unconditional. You will be expected to meet the revised deadline and to provide evidence of progress at the milestones you committed to. In some cases, particularly for major nonconformances, the certification body may schedule an additional on-site or remote review to verify that the corrective actions have been implemented effectively.
This additional review is sometimes called a follow-up audit or a special audit. It is not a full re-audit of your entire management system. It is focused specifically on verifying the corrective actions for the open finding. However, if the auditor notices other issues during this visit, they are obligated to raise them. So do not treat the follow-up audit as a rubber stamp. Make sure your system is in good shape, not just the specific area being reviewed.
It is worth noting that additional audit visits cost money. Depending on your certification body's pricing structure, a follow-up audit may be charged at a half-day or full-day rate. Factor this into your planning so you are not caught off guard.
When the Certification Body Suspends Your Certificate
If the deadline passes and you have not closed the nonconformance or secured an extension, suspension is the likely outcome. A suspended certificate means you cannot legitimately use your certification mark or claim certification status. This can have immediate commercial consequences, particularly if clients or government procurement requirements expect you to hold a current certificate.
Suspension is not the same as withdrawal. During suspension, the certificate still exists but is temporarily inactive. To lift a suspension, you typically need to close the nonconformance and submit evidence to the certification body. They will review it, and if satisfied, they will lift the suspension and reinstate your certificate. The time your certificate spends in suspension does not extend your certification cycle. Your next surveillance audit date and recertification date remain the same.
If your certificate is suspended and you are working with clients who require ISO certification, you need to be transparent about the situation. Claiming active certification when you are suspended is a misuse of the certification mark and can have serious consequences. The article on what happens if you falsely claim ISO certification covers this in detail and it is not a situation you want to find yourself in.
Certificate Withdrawal: The Worst Case Scenario
If suspension continues beyond the certification body's maximum allowed period without resolution, the certificate will be withdrawn. Withdrawal means your certification is cancelled and removed from the certification body's public register. Anyone who looks up your certificate will see that it has been withdrawn, which is damaging to your reputation.
To regain certification after withdrawal, you typically need to go through the full certification process again, including a Stage 1 and Stage 2 audit. There is no shortcut. The time and cost involved in starting over is significantly greater than the effort required to close a nonconformance in time, which is why proactive communication is so important.
Practical Steps to Take Right Now If You Are Running Out of Time
If you are reading this because you are currently in this situation, here is what you should do immediately.
- Stop and assess your realistic completion date. Be honest with yourself about how long the corrective action will actually take. Do not commit to a date you cannot meet just to buy time.
- Contact your certification body today. Do not wait until the deadline has passed. An early call or email explaining the situation is far better received than a missed deadline with no communication.
- Document everything you have done so far. Even partial progress is evidence of good faith. Collect it and present it clearly.
- Get the right people involved. If the nonconformance requires a decision from senior management or a budget allocation, escalate it internally now. Do not let internal delays compound the problem.
- Ask your certification body specifically what evidence they need. Different auditors and certification bodies have different expectations for what constitutes adequate closure evidence. Asking directly saves you from submitting something that will not be accepted.
If you are unsure how to run internal audits effectively so that nonconformances are caught and addressed before external audits, the article on how to run ISO internal audits that actually find problems is a practical starting point.
Preventing This Situation in the Future
The best way to handle a nonconformance closure deadline is to never be in a position where you cannot meet it. That sounds obvious, but it requires some structural changes to how most businesses manage their corrective action process.
First, treat corrective actions as a standing agenda item at management review meetings. If corrective actions are reviewed monthly by leadership, they are far less likely to drift past their deadlines unnoticed. Second, assign a single named owner to every corrective action, not a team or a department. Collective responsibility tends to mean no one takes responsibility. Third, build your corrective action timelines conservatively. If you think it will take four weeks, commit to six. It is far better to close a finding early than to request an extension.
Finally, make sure your internal audit program is genuinely effective. Many nonconformances raised at external audits could have been caught and addressed internally first. A strong internal audit program is your early warning system. It gives you the opportunity to fix things before an external auditor finds them.
Getting the Right Support
If you are struggling to manage nonconformances, corrective actions, or your overall management system, working with an experienced ISO consultant can make a significant difference. A good consultant will not just help you close the immediate finding. They will help you build processes that prevent the same issues from recurring.
If you need help finding a qualified consultant or a certification body that communicates clearly and works with you through these challenges, CertBetter connects businesses with vetted ISO consultants and accredited certification bodies. You submit one form and receive up to three competing quotes from verified providers, at no cost to your business. It is a practical way to find the right support without spending weeks searching and comparing options on your own.
