What is a nonconformity in an ISO 14001 audit?
A nonconformity is a failure to meet a requirement - of the standard, of the applicable legislation or of the rules the organization itself has set in its environmental management system. The auditor records it only when there is objective evidence: a document, a record, an observation on site or a conversation with an employee.
Nonconformities are classified by severity. A major nonconformity is one that raises doubt about the ability of the system to achieve its intended results - for example a whole requirement of the standard is missing, or a legal obligation is systematically not met. A minor nonconformity is an isolated lapse that does not disrupt the system as a whole. An observation is a recommendation - it is not a nonconformity, but it may become one at the next audit if it is ignored.
The certificate is not issued until the organization removes the cause and the certification body verifies the result - through documents or an additional visit.
The organization submits a root-cause analysis and a plan to remove it; implementation is verified at the next surveillance audit.
Which are the 10 most common nonconformities?
The list below follows the clauses of ISO 14001 and summarizes what auditors most often find in manufacturing, construction and trading companies. Against each nonconformity you will see exactly what the auditor checks and how to prevent it.
| Nonconformity | Clause | How to avoid it |
|---|---|---|
| The register of environmental aspects is incomplete or has no significance evaluation | 6.1.2 | Include all activities, products and services, including emergency situations and suppliers; define significance criteria and apply them consistently. |
| Legal requirements are described in general terms, without specific obligations | 6.1.3 | Keep a register by law, regulation and permit with the specific obligation, deadline and person responsible; update it whenever something changes. |
| There is no evaluation of compliance with legal requirements | 9.1.2 | Check periodically that each obligation is being met and record the result - this is a separate requirement from the register itself. |
| Expired permits, missing contracts and waste documentation | 8.1 | Track the expiry dates of permits and registration documents; keep the contracts and reporting documents for every waste stream. |
| Emergency preparedness exists only on paper | 8.2 | Identify the possible emergency situations from the aspects, run and document a drill, and review the procedure afterwards. |
| No evidence of competence and awareness | 7.2, 7.3 | Define who needs to know what, deliver the training and keep the records; ask employees whether they know the policy and the aspects of their own work. |
| Monitoring is done without calibrated instruments or without records | 9.1.1 | Define what, how and when you measure; calibrate the instruments and keep the results so that the trend is visible. |
| Environmental objectives are not measurable and have no plan | 6.2 | For every objective - an indicator, a deadline, resources, a person responsible and a way to track progress. |
| The internal audit and the management review are a formality | 9.2, 9.3 | Audit all processes according to a programme, with competent auditors; the management review should cover all the inputs required by the standard and end with decisions. |
| Nonconformities from previous audits were closed without a root-cause analysis | 10.2 | For every nonconformity - cause, action, deadline, verification of the result. Fixing the symptom is not a corrective action. |
What the ten points have in common: the auditor looks for records and evidence, not descriptions of intentions. If an activity exists but leaves no trace, for the audit it does not exist.
Where the auditor looks first: legal requirements
The most serious ISO 14001 nonconformities are almost always linked to a breached legal obligation, because the standard requires the organization to have determined its compliance obligations and to evaluate whether it meets them. In Bulgaria this means above all the Environmental Protection Act, the Waste Management Act, the Water Act and the Clean Ambient Air Act, together with the regulations and permits issued under them.
- Waste without documents
Waste classification, contracts with licensed companies, reporting and storage time limits - the most frequently checked topic on site.
- A permit that no longer matches the activity
A new emission source, a new installation or a new site, with no change in the permits or in the register of aspects.
- A self-assessment nobody has done
The register of laws exists, but nobody has checked whether each obligation is being met - clause 9.1.2 is left without evidence.
The register of compliance obligations is not a formality: it is the starting point for the aspects, the objectives, emergency preparedness and monitoring. When it is up to date and specific, half of the typical nonconformities disappear.
How to prepare before the audit: 6 checks
- 1Review the aspects against the real activity
Walk the sites with the register in hand. Every machine, chemical store, tank and waste stream must have its place in it.
- 2Reconcile the legal register with the permits
Collect all permits, registrations and contracts and check deadlines, scope and conditions. Note where there is a reporting obligation.
- 3Carry out an evaluation of compliance
For each obligation record: is it met, with what evidence, who is responsible. Enter any gaps you find as nonconformities with corrective actions.
- 4Test emergency preparedness
Run a drill for the most likely scenario - a spill, a fire, a leak - and document the result and the conclusions.
- 5Carry out an internal audit of all processes
With a programme, competent auditors and a report. If you have no trained internal auditor, that in itself is a gap under clause 9.2.
- 6Hold a management review
With all the inputs under clause 9.3 - audit results, legal compliance, objectives, aspects, resources - and with minutes recording the decisions.
The certification body cannot help you with implementation - this is an impartiality requirement under ISO/IEC 17021-1. Preparation is done by you or by an independent consultant; the auditor verifies the result.
What happens if the auditor finds a nonconformity?
The certification audit has two stages. At Stage 1 the auditor reviews the documentation and readiness - this is usually where incomplete registers and missing evaluations show up, and the organization is given time to complete them before Stage 2. At Stage 2 implementation is verified on site, and that is when nonconformities are recorded.
For a major nonconformity the certificate is not issued until the organization removes the cause and the certification body verifies the result. For a minor nonconformity a corrective action plan is submitted, and implementation is verified at the next surveillance audit. The certificate is valid for three years, with surveillance audits in the second and third year - so the same checks have to be repeated every year, not just before the first audit. How the whole process works - in Certification process.
- On-site audit, in BulgarianAudits are carried out in Bulgarian throughout the country, by auditors with experience in the relevant industry.
- Accredited certificateThe certificate is issued by CERTIND S.A., accredited by RENAR (No. SM 041) - ISO 14001 is within the scope of accreditation.
- Three years of validitySurveillance audits in the second and third year, recertification before expiry.
- Quote within two hoursDescribe your activity, sites and number of employees - you receive a quote within working hours.
If you are only now implementing the standard, read also why organizations get certified to ISO 14001, and if you already hold a certificate to the 2015 edition - the transition deadlines for ISO 14001:2026.
Questions about ISO 14001 nonconformities
What is a major nonconformity under ISO 14001?
A failure that raises doubt about the ability of the system to achieve its intended results - for example a whole requirement of the standard is missing, or a legal obligation is systematically not met. With a major nonconformity the certificate is not issued until the cause is removed and the certification body has verified the result.
What is the most common cause of a nonconformity in an ISO 14001 audit?
Legal requirements: an incomplete register of compliance obligations, expired permits, missing waste documentation and no evaluation of compliance under clause 9.1.2. This is where the auditor looks for evidence that every obligation is actually being met.
Can I get a certificate if the auditor finds minor nonconformities?
Yes. For minor nonconformities the organization submits a root-cause analysis and a corrective action plan, and implementation is verified at the next surveillance audit. A major nonconformity must be resolved before the certificate is issued.
Do I have to carry out an internal audit before certification?
Yes. The internal audit (clause 9.2) and the management review (clause 9.3) are requirements of the standard, and the auditor checks the records from them. They are also the surest way to find nonconformities yourself, before Stage 1.
Can the certification body help me resolve the nonconformities?
No. The certification body cannot provide consultancy to the organization it certifies - this is an impartiality requirement under ISO/IEC 17021-1. The auditor points out what does not meet the requirement, while the solution and its implementation are up to the organization or an independent consultant.