Non-conformance (major and minor)

A non-conformance, written up as an NC on most audit reports, is an auditor's recorded judgement that a named clause of the standard was not met, with the evidence they saw attached to it. It is not an opinion about your plant in general and it is not a warning: it is a finding against one clause, raised at one moment, that you now owe a response to.

Every NC has the same anatomy. There is the clause reference, the objective evidence the auditor observed or could not find, the grade they assigned, and a deadline for your corrective action. That structure is why an auditor's phrasing matters so much. "Allergen declarations were not available for two of six raw material suppliers sampled" is a document control finding you can close with documents. "The approved supplier procedure does not require allergen declarations to be current" is a finding against your system, and closing it means changing the procedure.

A worked example from the supplier file, because it is the one QA managers meet most often. The auditor asks for the certificate pack for three suppliers off your approved supplier list. Two are current. The third supplier's audit certificate expired four months ago and the copy on file is the old one. The clause requires you to hold evidence that approved suppliers remain approved, you cannot produce it, and an NC is raised on the spot.

The grades are set by the scheme you are audited against, not by the auditor's mood, and each scheme publishes its own definitions and consequences in its standard and audit protocol. Read the version of the protocol you are actually being audited to, because the wording and the grade names move between issues.

The working distinction, in the language auditors tend to use, is about whether the system held.

A minor non-conformance is a single lapse in an otherwise working system. The procedure exists, people follow it, and one record slipped. Minors usually close out on documentary evidence sent to the certification body after the audit, and they accumulate: enough of them in one report can move your grade even though no single one was serious.

A major non-conformance is a substantial failure to meet the requirement, or a lapse that raises real doubt about whether the product is being controlled. Majors generally demand root cause analysis rather than a replacement document, and they can carry a shortened certificate cycle, a follow-up visit or, in the worst case, a suspended certificate. Some schemes sit a critical grade above major for direct food safety or legality failures.

The practical difference to a QA manager is time. A minor is a task. A major is a project with a deadline, a root cause, and a conversation with your certification body.

Supplier document findings are a predictable NC source for one structural reason: the evidence expires on a date you did not choose and nobody is watching it. A CoA, an allergen declaration and a third-party audit certificate each have their own validity window, each sits with a different supplier contact, and nothing in a shared folder tells you the day one of them lapses.

So the finding is almost never "we never asked". It is "we asked eleven months ago, the certificate was valid then, and nobody asked again". The auditor is not assessing your intent, only what is on file on the day they look. That is also why the same NC comes back at the next audit unless the corrective action changes the chasing, not just the one file.

Closing one out follows the same path either way. Find the root cause, which is usually an absent trigger rather than an absent procedure. Fix the specific gap by getting the current document on file. Then put something in place that raises the question before the expiry date arrives, and keep the evidence that it is running.

• Corrective action and CAPA. The response you submit against an NC. Corrective action fixes the instance; a preventive or systemic action stops the cause recurring. Certification bodies ask for both on majors.
• Root cause. The reason the system allowed the lapse. "The expiry date was not tracked" is a root cause. "The supplier did not send it" usually is not, because it does not explain why nobody noticed.
• Close-out. Submitting evidence within the deadline and having the certification body accept it. An NC stays open until they do.
• Document control. The clause family that covers holding current, retrievable, correctly versioned records. Most expired-certificate findings land here or in supplier approval.
• Approved supplier list. The register of suppliers you have approved and the evidence behind each approval. See the sibling page on BRCGS supplier approval and performance monitoring for what evidence the clauses ask for.
• Unannounced audit. An audit with no agreed date, which removes the pre-audit week most plants use to catch up on paperwork. There is a sibling page on what that changes.