Receiving a non-conformity from a notified body during an audit is inevitable for the vast majority of manufacturers, including those with high-quality files. It is not the sign of a failing system — it is the normal function of the audit. What matters is how the manufacturer responds to it.
A good response to a notified body non-conformity closes the file. A poor response reopens it, with an additional delay and sometimes an escalation to a major non-conformity.
Types of non-conformities and their implications
Minor non-conformity. An isolated deviation or one with low impact on overall conformity. The response can be provided in writing with evidence of correction. Usual deadline: 30 to 90 days depending on the notified body.
Major non-conformity. A systemic failure or significant gap in the QMS or the technical documentation. It must be subject to a root cause analysis and a documented corrective action. The correction must be verified by the notified body, often during a follow-up audit. Usual deadline: 60 to 120 days.
Observation. Not a formal non-conformity, but a suggested point for improvement. A response is expected but the deadline is less constraining.
The structure of an effective response
Section 1: understanding the non-conformity. Reformulate the non-conformity in your own terms, in a way that demonstrates you have understood its full scope — not only the visible symptom, but the underlying systemic failure if there is one.
Section 2: root cause analysis. Why did this non-conformity occur? The analysis must be proportionate to the severity of the non-conformity. A 5 Whys analysis or an Ishikawa diagram for a systemic non-conformity, a simple factual analysis for an isolated deviation.
Section 3: corrective actions. What is the manufacturer doing to correct the non-conformity? Immediate correction (addressing the symptom) and corrective action (addressing the cause). The two must be distinguished. The corrective action must be proportionate to the identified cause.
Section 4: evidence of implementation. Notified bodies do not accept intentions — they accept evidence. An updated procedure, a modified record, training delivered, a test performed: documented evidence of implementation is essential.
Section 5: effectiveness verification. How will the manufacturer ensure that the corrective action has effectively eliminated the cause? Verification criteria, deadline, person responsible.
The most costly mistake
Responding quickly with little substance in order to close the exchange. A notified body that receives an insufficient response opens a second request for additional information, which lengthens the certification timeline and signals a manufacturer that does not understand its own problems.