Clients call me the week after a surveillance audit convinced they've lost their certificate. Usually they haven't. What they've got is a nonconformity report, a deadline, and a decision to make about how seriously to take both. The gap between those two things — "I failed" and "I have thirty to ninety days to fix something specific" — is where most of the panic lives, and it's worth clearing up before you do anything else.
I've sat across the table from quality managers reading their first major nonconformity like it's a diagnosis. It isn't. It's a work order. But the clock attached to it is real, and if you let it run out, the consequences stop being hypothetical.
There's No "Pass or Fail" — There's a Clock
ISO management system audits, whether against ISO 9001, ISO 13485, ISO 27001, or ISO 42001, don't produce a pass/fail grade the way a driving test does. They produce findings, classified by severity, each carrying its own response window under your certification body's rules and the accreditation standard behind them, ISO/IEC 17021-1:2015. What actually threatens your certificate isn't the finding itself. It's what you do with the time you're given after it.
That said, "nothing happens" is the wrong lesson too. A surveillance audit with unresolved major nonconformities is a genuine threat to your certification, and the process from finding to suspension to withdrawal is faster than most operations leaders expect. Here's how it actually plays out.
The Three Findings That Actually Matter
Every certification body I've worked with, and every scheme I've audited under, sorts findings into the same three buckets. The words vary slightly by body, but the substance doesn't.
| Finding Type | What It Means | Typical Response Window | Certificate Risk |
|---|---|---|---|
| Opportunity for Improvement (OFI) | Not a nonconformity — a suggestion, sometimes tied to an emerging risk | No formal deadline; addressed at your discretion | None directly |
| Minor Nonconformity | An isolated lapse in an otherwise functioning process — a missed record, a training gap, a single deviation from your own documented procedure | Typically 30–90 days, or verified at the next scheduled visit, per your certification body's rules | Certificate stands; repeated or unaddressed minors can be reclassified as a major |
| Major Nonconformity | A systemic breakdown, a missing required element of the standard, or an accumulation of related minors that add up to a process failure | Typically 30–90 days for a corrective action plan and evidence of closure, set by the certification body | Certificate suspension if not resolved within the agreed timeframe |
Note what isn't on that table: "Observation." Some certification bodies use it informally, but it isn't a defined term in ISO/IEC 17021-1 or in most accredited audit schemes, and I don't put it in a report. If a finding is worth writing down, it belongs in one of the three categories above. Anything softer than that is a conversation, not a citation.
The distinction between minor and major matters more than most people realize going in. A major nonconformity under ISO 9001:2015 clause 8.5.1 (control of production and service provision) reads very differently to a certification body than a minor one under clause 7.5.3 (control of documented information), even though both are technically "nonconformities." Severity is judged by impact on the management system's ability to deliver conforming product or service, not by how long the finding paragraph runs.
What Actually Happens the Day of the Audit
The auditor doesn't decide your certificate's fate on-site. They document the finding against a specific clause, gather objective evidence (a record, an observation, an interview note), and classify it. Before they leave, you sign the nonconformity report acknowledging you received it — signing isn't agreement that you're wrong, just confirmation you know it exists.
Within a few weeks, the audit report goes to a technical reviewer at the certification body, someone who wasn't in the room, whose job is to check that the finding is properly supported and correctly classified. This is a real check, not a rubber stamp: reviewers do downgrade major findings to minor, and occasionally the reverse, when the evidence doesn't match the classification the auditor used.
Then the clock starts. You'll typically submit a root cause analysis and a corrective action plan within a set number of days (commonly 10–15 for the plan itself), and evidence that the corrective action is implemented and effective within the full response window the certification body assigned.
The Corrective Action Clock: How Long You Actually Have
Certification bodies vary in their exact numbers, but the pattern across ANAB- and UKAS-accredited bodies is consistent enough to generalize.
| Stage | Typical Deadline | What's Required |
|---|---|---|
| Acknowledge the finding | At the closing meeting | Signature on the nonconformity report |
| Submit corrective action plan | 10–15 days after the audit | Root cause analysis + planned corrective action |
| Close a minor nonconformity | 30–90 days, or by next surveillance visit | Evidence the correction and correction are implemented |
| Close a major nonconformity | 30–90 days (certification body sets the exact figure) | Evidence of implementation AND effectiveness, often via a follow-up visit |
| Certificate suspension | If major NC unresolved at deadline | Certificate inactive; cannot be referenced to customers |
| Certificate withdrawal | Up to 6 months after suspension begins | Certification terminated; recertification audit required |
ISO/IEC 17021-1:2015 clause 9.6 is the operative text here, and it caps suspension at six months. A certification body cannot leave your certificate in suspended limbo indefinitely — it has to be reinstated or withdrawn within that window. That's a hard ceiling, not a certification body's internal preference, and it's the single most important number in this whole process to have memorized.
When Nonconformities Escalate: Suspension
Suspension is what happens when a major nonconformity blows through its deadline without acceptable closure evidence, or when a pattern of unresolved minors adds up to a systemic failure the certification body decides warrants the same treatment. It is not a formality. During suspension:
- Your certificate is inactive. You cannot market, advertise, or represent yourself as certified.
- Your listing typically disappears from the certification body's public registry, or gets flagged as suspended if the registry shows status history.
- Customers and prime contractors who require the certification as a condition of doing business can treat you as non-compliant for the duration.
- The certification body will usually schedule a special or short-notice audit to verify the corrective action before lifting the suspension.
I've watched suspension cost a client a defense-sector subcontract because the prime's procurement system flagged the certificate status automatically, before anyone on either side had a conversation about it. The suspension lasted eleven days. The contract did not come back. That's the real cost of suspension: it's not the paperwork, it's the six weeks of silence from a customer who saw "suspended" in a database and moved on without calling to ask why.
Withdrawal: The Scenario People Actually Mean by "Failing"
If the underlying nonconformity still isn't resolved by the end of the suspension window, or if you don't respond to the certification body's requests at all, certification is withdrawn. This is the closest thing to "failing" in the colloquial sense: your certificate is gone, your listing is removed, and you start over.
Starting over means a recertification audit at the same depth as your original certification audit, not a lighter surveillance-style visit. Depending on your certification body and the standard, this can mean a full two-stage audit again: a Stage 1 document and readiness review, then a Stage 2 implementation audit. For a mid-sized manufacturer, that's typically a multi-week gap between application and a new certificate, plus the audit fees you already thought you'd paid once.
The organizations that end up here almost never got there because of one bad finding. They got there because a major nonconformity sat on someone's desk for ninety days while the team hoped the next audit cycle would somehow resolve it on its own. Deadlines attached to nonconformities do not soften with neglect. They convert directly into suspension deadlines, and suspension deadlines convert directly into withdrawal.
Recertification After Withdrawal: What It Actually Costs
Beyond the audit fee itself, withdrawal costs you the certificate-free interval, however long it runs, during which any contract, bid, or customer relationship that requires current certification is at risk. It costs you the internal credibility of a quality or EHS function that has to explain to leadership why the system failed twice: once at the original audit and again in not closing the gap in time. And it resets your surveillance clock. You're back to Year 1 of a new three-year cycle, with a Stage 1 and Stage 2 audit ahead of you rather than a routine annual visit.
None of that is a reason to panic when a nonconformity lands. It's a reason to treat the corrective action deadline as the real event, not the audit day itself.
How to Avoid Ever Finding Out What Suspension Feels Like
The organizations that never end up in suspension share a few habits, and none of them are exotic:
They treat root cause analysis as the actual deliverable, not the corrective action plan. A corrective action that doesn't trace back through clause 10.2's requirement for root cause tends to fix the symptom the auditor happened to sample and leave the underlying gap intact for next year.
They close nonconformities early, not at the deadline. Certification bodies read a corrective action plan submitted on day 12 differently than one submitted on day 89 of a 90-day window, even when both are technically compliant. Early closure also gives you runway if the certification body pushes back on your evidence and asks for more.
They run their own internal audits like the certification body will. ISO 9001:2015 clause 9.2 already requires this, and organizations that treat internal audits as a genuine dry run, sampling the same processes an external auditor would, catch major-shaped problems while they're still minor-shaped.
They read the actual clause, not the auditor's summary. A nonconformity written against clause 8.5.1 means something specific and is closed with specific evidence. I've seen corrective action plans rejected twice by a certification body because the team fixed what they assumed the auditor meant instead of what the clause and the objective evidence in the report actually said.
If you're inside a corrective action window right now and want a second set of eyes on whether your root cause analysis will actually satisfy the certification body before you submit it, that's a conversation worth having before the deadline, not after the follow-up audit comes back with the same finding restated. It's also worth having someone independently review your management system before the next surveillance cycle even opens — a gap assessment against the standard's actual clause structure catches the pattern of minors before an auditor turns it into a major.
FAQ
Is there such a thing as "failing" an ISO surveillance audit?
Not in a pass/fail sense. Surveillance audits produce findings classified as an opportunity for improvement, a minor nonconformity, or a major nonconformity. Your certificate is only at risk if a major nonconformity (or an accumulated pattern of minors) goes unresolved past the deadline your certification body sets, typically 30 to 90 days.
What's the real difference between a minor and a major nonconformity?
A minor nonconformity is an isolated failure in an otherwise functioning process. A major nonconformity is a systemic breakdown, a missing required element of the standard, or a cluster of related minors serious enough to call the whole process into question. Only unresolved majors trigger suspension.
How long do I have to fix a nonconformity before my certificate is at risk?
Certification bodies typically set 30 to 90 days for closure evidence on a major nonconformity, after requiring a corrective action plan within 10 to 15 days of the audit. Deadlines vary by certification body, so check your specific audit report and client agreement rather than assuming a standard number.
Can my certificate actually be suspended after a surveillance audit?
Yes. If a major nonconformity isn't closed with acceptable evidence by the deadline, the certification body suspends the certificate. ISO/IEC 17021-1:2015 clause 9.6 caps suspension at six months, after which the certification body must either reinstate the certificate or withdraw it.
What happens if the nonconformity still isn't fixed after suspension?
Certification is withdrawn. Getting certified again requires a full recertification audit, generally a Stage 1 and Stage 2 process comparable to your original certification, not a lighter surveillance visit. You also restart your three-year certification cycle from the beginning.
Last updated: 2026-08-07
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.