Every environmental management system (EMS) will, sooner or later, fail to do what it promised. A spill happens, a permit limit is missed or a monitoring task is skipped. What matters to ISO 14001 is not that it happened but what the organization did next. This guide explains nonconformity and corrective action, the difference between fixing a problem and removing its cause, and how an auditor checks both. It is written for auditors working to ISO 14001 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 14001 Lead Auditor course.

What is a nonconformity in ISO 14001?

A nonconformity is the non-fulfilment of a requirement.

The requirement may come from ISO 14001 itself, from the organization’s own EMS documents, or from its compliance obligations, such as a permit condition. A nonconformity can come from an audit, a complaint, an incident, a monitoring result or a routine check. An observation or an opportunity for improvement is not a nonconformity, because no requirement has been missed. Our guide to what an ISO 14001 environmental management system is sets the background, and our guide to ISO 14001 compliance evaluation shows one common source of nonconformities.

What does ISO 14001 ask the organization to do?

It asks the organization to react, correct, find the cause, act, check the result and keep records.

The table follows the order of the nonconformity and corrective action requirement in ISO 14001:2015, which sits in the improvement section of the standard. Read the same part of ISO 14001:2026 for its exact wording and numbering, because the edition was revised and this guide does not quote the new text. The steps below are the long-standing logic of the requirement.

Corrective actions must be appropriate to the significance of the effects of the nonconformity. A minor paperwork slip does not need the same response as a release to a watercourse.

A fix that leaves the cause in place is an invitation for the problem to return.

What is the difference between correction and corrective action?

Correction deals with the problem in front of you, while corrective action removes the cause so it does not return.

Take a drum of used oil found leaking in a store. Correction is to stop the leak, contain and clean the spill and move the oil. Corrective action asks why it leaked: was the drum damaged, was it stored without a bund, was the weekly store check skipped? The answer decides the action, such as new storage, a changed check or training. Auditors often find correction presented as corrective action, which is why they ask for the cause. Our guide to operational control in ISO 14001:2026 shows how controls are meant to prevent such events.

How do you find the cause of a nonconformity?

Ask why until you reach a cause the organization can change, and check whether the same cause exists elsewhere.

A cause analysis can be simple. A common method is to ask why repeatedly until you reach something that management can fix, such as a missing procedure, a gap in training, a poor design or a lack of resources. Stopping at “the operator made a mistake” rarely helps, because it does not explain why the system allowed it. The requirement also asks whether similar nonconformities exist or could occur, so look at other sites, shifts or processes that share the cause.

1. State the problem in a sentence, with the requirement that was missed.
2. Ask why several times, following the evidence, not opinion.
3. Test the cause by asking whether removing it would have prevented the problem.
4. Check for similar cases elsewhere in the EMS.
5. Choose an action proportionate to the significance of the effects.

How do you audit nonconformity and corrective action?

Pick a sample of recorded nonconformities and trace each one from detection to the check that the action worked.

Ask for the log of nonconformities, complaints and incidents, and the internal audit findings. Choose cases of different kinds, such as one from an audit, one from monitoring and one involving a compliance obligation. For each, follow the chain and ask for evidence at every step. Our guide to how to conduct an ISO 14001 internal audit and our guide to internal audit in ISO 14001:2026 show where many findings start.

Treat a comment as a lead and confirm it with a record or an observation. Our guide to management review in ISO 14001:2026 shows where trends in nonconformities should be reviewed.

How do you write a clear nonconformity finding?

A clear finding states the requirement, the evidence and the gap, in plain words.

As an auditor, you also raise nonconformities, and a weak finding is hard to act on. State the requirement that was not met, the objective evidence you saw and the gap between them. Avoid opinions and avoid prescribing the solution, because choosing the corrective action is the organization’s job. Many certification bodies grade findings by severity, so follow the rules of the body or program you work for. Our ISO 14001 MCQ questions and answers and our sample exam questions and answers let you practice these definitions.

• Requirement. Name the clause, procedure or obligation that was missed.
• Evidence. Describe what you saw, read or heard, with dates and references.
• Gap. Say plainly how the evidence falls short of the requirement.

What gaps do auditors commonly find?

Common gaps are fixes without causes, no check on effectiveness, no records and repeat problems.

• Correction only. The leak is cleaned up but nobody asks why it happened.
• Shallow cause. “Operator error” is recorded as the root cause.
• No effectiveness check. The action is closed when it is done, not when it works.
• Disproportionate response. A serious release gets the same effort as a minor slip.
• Repeat nonconformities. The same finding returns audit after audit.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 14001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for exam preparation, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. For any question, contact the 3FOLD team.