8 min read
What Is a Nonconformity in ISO 14001?
A plain-language definition, what does and does not count, where nonconformities come from and how to tell one from an observation.
3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853) · Licensed by KHDA, Dubai
Few words cause more worry in an audit than nonconformity. Yet the idea is simple: it is a requirement that has not been met. Understanding exactly what counts, and what does not, helps both the people being audited and the people auditing. This guide explains the term as ISO 14001 uses it, with examples, and shows how it differs from an observation. It is for managers running an environmental management system (EMS) and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 14001 Lead Auditor course. Always check the exact wording in the current standard.
In ISO 14001, a nonconformity is the non-fulfillment of a requirement. The requirement can come from the standard itself, from the organization’s own EMS documents, or from its legal and other compliance obligations. When one is found, clause 10.2 asks the organization to react, control and correct it, deal with the consequences, evaluate the need for action to remove the causes, implement that action, review its effectiveness and keep records.
| Standard | ISO 14001 (Edition 4, 2026 replaces the 2015 edition) |
| Definition | Non-fulfillment of a requirement |
| Requirements can be | The standard, the organization’s own system, compliance obligations |
| Response clause | 10.2, nonconformity and corrective action |
| Not the same as | An observation or an opportunity for improvement |
| Related course | ISO 14001 Lead Auditor · PR376 · CQI and IRCA |
How does ISO 14001 define a nonconformity?
It defines it as the non-fulfillment of a requirement.
That short definition does a lot of work. A nonconformity is not a bad feeling about a process or a better way of doing things. It is a gap between what a requirement says and what actually happens, backed by evidence. Our guide to ISO 14001 nonconformity and corrective action covers what to do about one in depth, and our guide to what an ISO 14001 environmental management system is explains the system being audited.
Which requirements can a nonconformity be raised against?
Against the standard, the organization’s own documents and its compliance obligations.
| Source of requirement | Example |
|---|---|
| ISO 14001 itself | No internal audit program has been planned |
| The organization’s own EMS | A procedure says waste is checked weekly, but no checks were done |
| Compliance obligations | A permit condition on storage is not being met |
| Other commitments | A customer requirement the organization agreed to follow is missed |
This is why an organization is audited against what it says it does as well as against the standard. Our guide to ISO 14001 compliance evaluation covers the compliance side.
A nonconformity is a gap between a requirement and what happens, and it must be backed by evidence.
Want to practice auditing a real process? The course includes editable audit working documents and a case study.
What is not a nonconformity?
An opinion, a preference, a better idea or a gap with no requirement behind it.
- Observation. Something that is not yet a failure but could become one, noted for attention.
- Opportunity for improvement. A suggestion that goes beyond what the requirement asks.
- Personal preference. The auditor would do it differently but no requirement is missed.
- Unsupported claim. Something heard but not confirmed with a record or observation.
An auditor must be able to say which requirement was not met and what evidence shows it. If either is missing, it is not a nonconformity. Our guide to how to conduct an ISO 14001 internal audit shows how evidence is gathered.
Where do nonconformities come from?
From internal audits, external audits, monitoring, compliance checks, complaints and incidents.
An organization finds nonconformities in many ways. Internal audits and certification audits are the best known, but monitoring and measurement, evaluation of compliance, management review, complaints from neighbors or customers and environmental incidents all reveal them too. Whatever the source, clause 10.2 applies in the same way. Our guide to internal audit in ISO 14001:2026 and our guide to management review in ISO 14001:2026 show two of these routes.
What does a nonconformity look like in practice?
It is a stated requirement, a piece of evidence and a gap between them.
| Requirement | Evidence | Gap |
|---|---|---|
| Evaluate compliance at planned frequencies (clause 9.1.2) | No compliance evaluation record for the last year | Evaluation was not carried out |
| Control operations linked to significant aspects (clause 8.1) | Chemical store has no spill kit, though the procedure requires one | The control is not in place |
| Keep documented information (clause 7.5) | Waste transfer notes missing for two months | Records were not kept |
Our guide to operational control in ISO 14001:2026 explains the control requirement shown in the second row.
Want to see how an internal audit checks this? Read our step-by-step guide.
What must happen after a nonconformity is found?
Correct it, find the cause, act on it and check that the action worked.
- React to the nonconformity, control and correct it, and deal with the consequences.
- Evaluate whether action is needed to remove the causes so it does not recur.
- Implement the action that is needed.
- Review whether the action was effective.
- Update the EMS if necessary and keep documented information as evidence.
How are nonconformities graded?
ISO 14001 does not grade them, but certification bodies often use major and minor.
The standard defines nonconformity but does not set grades. Certification bodies commonly grade findings, for example as major or minor, under their own rules, and these rules decide the time allowed to respond. Ask your certification body how it grades findings. ISO 14001:2026 is Edition 4 and replaces the 2015 edition. According to the CQI and IRCA summary of key updates, it adds planning of changes (6.3) and risks and opportunities (6.1.4), so check how new requirements will be audited. Our guide to what is ISO 14001:2026 sets out the changes.
Nonconformity simulation: choose the best auditor action
For practice only. Read each situation and choose the best response. These scenarios were written by 3FOLD Training and are not real exam questions or legal advice.
1 scenario answered: 1 of 1 correct
Preloaded example: Situation 1 is already answered. A gap against the site own procedure is a nonconformity.
Frequently asked questions
What is a nonconformity in ISO 14001?
In ISO 14001 a nonconformity is the non-fulfillment of a requirement. The requirement can come from the standard, from the organization’s own environmental management system documents, or from its compliance obligations. Always check the definition in the current standard.
What is the difference between a nonconformity and an observation in ISO 14001?
A nonconformity is a requirement that has not been met, supported by evidence. An observation is something noted for attention that is not yet a failure to meet a requirement. Observations and opportunities for improvement are not nonconformities.
What does ISO 14001 require when a nonconformity occurs?
Clause 10.2 asks the organization to react and, as applicable, take action to control and correct it and deal with the consequences, evaluate the need for action to eliminate the causes, implement the action, review its effectiveness, change the EMS if necessary and keep documented information.
Does ISO 14001 define major and minor nonconformities?
No. ISO 14001 defines nonconformity but does not grade it. Certification bodies commonly grade findings as major or minor under their own rules, so ask your certification body how it grades.
Can a nonconformity be raised against the organization’s own procedure?
Yes. If the organization’s own EMS says something must be done and it is not done, that is non-fulfillment of a requirement. Auditors audit against the standard, the organization’s own documents and compliance obligations.
Where do ISO 14001 nonconformities come from?
They come from internal and external audits, monitoring and measurement, evaluation of compliance, management review, complaints and incidents. Clause 10.2 applies whatever the source.
Does the ISO 14001 Lead Auditor course teach how to write nonconformities?
According to the 3FOLD Training course page, the ISO 14001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT) and teaches the audit method, which includes reporting findings. We prepare you for the exam; CQI and IRCA examine and certify.
Where 3FOLD Training fits
3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 14001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for exam preparation, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. For any question, contact the 3FOLD team.
Ready to audit with confidence? Check the next batch and see what the course includes.
UAE mobile and WhatsApp: +971 50 481 9989
India mobile: +91 91762 57536
Chennai: Plot No: 1342, HIG, TNHB Main Road, Sithalapakkam, Chennai 600126
Monday to Friday 9:00 am to 5:00 pm, Saturday 9:00 am to 2:00 pm. See the 3FOLD Training contact page for all details.
Leave a reply