At the closing meeting of an ISO 27001 audit, the lead auditor reads out the findings and their grades. For most teams, the only question that matters in that moment is whether any of them is major. A major at stage 2 means the certificate will not be recommended until it is resolved.
The grading feels like a judgment call, and partly it is. But it follows published definitions, and the patterns that produce majors are predictable enough to plan against.
This article covers where the grades are defined, what pushes a finding into each one, what each grade means for your certificate, and what to do if you think a grade is wrong.
Where the grades are defined
ISO/IEC 27001 does not define major or minor. The standard only uses "nonconformity", meaning the non-fulfillment of a requirement.
The grades come from the rules that govern certification bodies. ISO/IEC 17021-1, the requirements for bodies that audit and certify management systems, defines them:
Major nonconformity: a nonconformity that affects the capability of the management system to achieve its intended results.
Minor nonconformity: a nonconformity that does not affect that capability.
ISO/IEC 27006 adds requirements specific to ISMS certification on top of 17021-1. Each certification body then writes its own procedures for applying the definitions, including the timescales it gives you to respond. Your contract or audit plan should tell you where to find them. If it does not, ask before stage 1.
The "requirement" in question can come from ISO 27001 itself, from your own ISMS documentation, or from legal and contractual obligations you have brought into scope. A policy you wrote is a requirement you set yourself.
What makes a finding major
The test is capability: can the ISMS still do its job? Auditors look for evidence that a requirement is not met at all, or that the failure is systemic rather than isolated. In practice, majors tend to come from a short list of patterns.
A management system clause has not been carried out. No internal audit has been completed. No management review has taken place. There is no risk assessment, or the risk assessment does not follow the method you documented. These are the clauses that make the ISMS a system, so their absence goes to capability directly.
A control is declared but missing. Your Statement of Applicability says a control is implemented and the auditor finds nothing behind it across the scope. A sampled exception is one thing. A control that does not exist is another.
Several minors point at the same weakness. ISO/IEC 17021-1 notes that a number of minor nonconformities against the same requirement or issue can demonstrate a systemic failure, and so amount to a major. Three late leaver revocations, a stale access review, and an unreviewed admin group might each be minor alone. Together they can say your access management process is not working.
There is significant doubt that the process is under control. If the auditor cannot establish that a required process operates reliably, the doubt itself can justify a major.
What a minor looks like
A minor is a real failure in a process that otherwise works. The process exists, it is followed most of the time, and the lapse is contained. Typical patterns, described here as hypothetical examples:
One leaver's account in a sampled system was removed a week after their last day, when the policy says one business day.
A topic-specific policy is past the review date it states.
A supplier added during the year has no recorded assessment, though the supplier process is otherwise followed.
The internal audit program did not cover one Annex A control area that was planned for this cycle.
A minor still needs a correction, a cause, and a corrective action. It is not a comment to file. Left alone, it is the raw material for a major at the next audit.
Opportunities for improvement
Many certification bodies also record opportunities for improvement, sometimes called observations. These are not nonconformities. ISO 19011, the guidance on auditing management systems, describes audit findings as indicating conformity or nonconformity, and notes that they can also identify opportunities for improvement.
You are not required to act on them, but you should record a decision either way. An auditor at the next surveillance audit may ask what you did. An observation that has become a failure since then is a nonconformity the second time.
What each grade means for your certificate
The consequences depend on the audit and on your certification body's procedures. The pattern is consistent enough to summarize.
| Grade | At stage 2 | At surveillance or recertification | What you submit |
|---|---|---|---|
| Major | Certification is not recommended until corrections and corrective actions are verified | Can lead to suspension, or block renewal, if not resolved in time | Cause analysis, correction, corrective action, and evidence they are effective |
| Minor | Certification can proceed once an acceptable action plan is agreed | Recorded and followed up at the next audit | Cause analysis and a plan for correction and corrective action |
| Opportunity for improvement | No effect | No effect | Nothing required |
For a major, verification may be a short follow-up visit or a review of documentary evidence, at the certification body's discretion. ISO/IEC 17021-1 requires the certification body to tell you which it needs. The timescales are set in its procedures and are not open-ended, so plan to start work the day after the closing meeting.
If you disagree with a grade
Disagreements are best settled at the closing meeting, while the evidence is fresh. Ask the auditor three questions:
Which requirement, exactly, is not met?
What evidence did you see, or not see?
Why does this affect the capability of the ISMS, rather than being an isolated lapse?
If the finding rests on a factual mistake, such as a record the auditor did not see, show the record. Auditors correct findings when the evidence supports it. If the disagreement is about judgment, ask for it to be noted. ISO/IEC 17021-1 requires certification bodies to have a process for handling appeals, and your certification body's process will be described in its published procedures.
Use that route sparingly. An appeal is a formal step, and most grading disputes resolve once both sides look at the same requirement and the same evidence.
Keeping majors out of stage 2
Majors are rarely surprises. They come from the parts of the ISMS that were not exercised before the audit. Four checks catch most of them.
Complete the internal audit across the whole scope. Cover every clause, and the Annex A controls planned for this cycle. See running the ISO 27001 internal audit.
Hold a real management review. Every input clause 9.3.2 lists, every output recorded. See the ISO 27001 management review, done properly.
Test the Statement of Applicability against reality. For each control marked implemented, find the evidence. A control you cannot evidence should be fixed or its status corrected before the auditor arrives.
Look for clusters. Group your own internal findings by requirement. Three internal findings in one area are the pattern an external auditor will call systemic.
Stage 1 is also an early warning. Issues raised there that are not resolved before stage 2 can become nonconformities, as described in ISO 27001 stage 1 vs stage 2 audits.
How TrustLynce helps
TrustLynce keeps audit findings, auditor requests, and their evidence together in the auditor portal, with each finding linked to the control and requirement it was raised against. Continuous monitoring routes control failures to their owners as they happen, so clusters show up in your own data before an auditor finds them.