What is a calibration nonconformity?

It is a calibration requirement that was not met, found at an audit. The requirement can come from the standard, such as ISO 9001 clause 7.1.5, from a customer or from your own procedure. A gage used past its due date is one example. A failed calibration with no impact assessment is another.

What is the difference between correction and corrective action?

A correction fixes the nonconformity you found, such as calibrating an overdue gage. A corrective action removes the cause so the problem does not recur, such as changing how due dates are tracked. ISO 9000:2015 defines both, and an auditor expects to see both in your answer.

How do you write a root cause for an audit finding?

Ask why the process allowed the nonconformity, and keep asking until the answer is something in the process you can change. Write down each step of the analysis. Do not stop at a person, such as operator error, because that does not explain why the process let the error through.

What evidence closes a corrective action?

Records that show the change happened and works. That can be the corrected calibration record, the result of the search for similar problems, the revised procedure, training records and records from the weeks after the change. The certification body reviews them and may verify on site.

What is the difference between a major and a minor nonconformity?

Under ISO/IEC 17021-1, a major nonconformity affects the management system's ability to achieve its intended results, and a minor one does not. Several minor findings against the same requirement can add up to a major one. Before its decision, the certification body verifies the correction and corrective action for a major and accepts your plan for a minor.

How long do you have to respond to an audit finding?

Your certification body sets the time, and it is agreed at the closing meeting. ISO/IEC 17021-1 requires a defined time for the response. For a major nonconformity at an initial certification audit, the body must verify the correction and corrective action within six months after the last day of stage 2, or it runs another stage 2 audit before it recommends certification. Some schemes fix the deadline. Under the IATF rules for IATF 16949, the first response to a major nonconformity is due within 15 calendar days.

Compliance and audits

Calibration audit findings: how to answer a nonconformity

11 min read Published November 7, 2026

To answer a calibration nonconformity, correct the problem the auditor found, check whether it exists anywhere else, find the cause in your process and change the process so it does not recur. Then show evidence for each step. ISO 9001 clause 10.2 sets out these steps, and your certification body reviews your answer and verifies that it worked before it closes the finding.

On this page

Read the finding first

A nonconformity is a requirement that was not met. A written finding names the requirement, usually a clause of the standard or of your own procedure. It describes what the auditor saw, which is the objective evidence. Then it states the nonconformity that links the two. ISO/IEC 17021-1:2015, the standard accredited certification bodies work to, requires each nonconformity to be recorded against a specific requirement with the evidence described in detail.

Read the requirement before the evidence. A finding about one overdue gage, written against ISO 9001 clause 7.1.5.2, is about calibration at specified intervals. The answer is a due-date process that works, not one recalibrated gage.

The auditor discusses each nonconformity with you so the evidence is accurate and understood. The same standard tells auditors not to suggest the cause or the solution, so the analysis is yours. If you believe the evidence is wrong, say so before the audit ends. The audit team leader tries to resolve the disagreement, and anything left unresolved is recorded.

Major, minor and opportunities for improvement

ISO/IEC 17021-1 calls a nonconformity major when it affects the management system's ability to achieve its intended results, and minor when it does not. A note gives two cases that can make a finding major. One is significant doubt that process control is effective or that product will meet requirements. The other is a set of minor findings against the same requirement that shows a systemic failure.

The grade changes what the certification body needs before its decision. For a major nonconformity it reviews, accepts and verifies your correction and corrective action. For a minor one it reviews and accepts your plan, and it can confirm the result at a later audit.

An opportunity for improvement is not a nonconformity. It needs no formal answer, although it is often worth acting on. A finding that is a nonconformity may not be written up as an opportunity for improvement.

Internal audits and customer audits use similar terms. Their grades and deadlines follow the auditor's own procedure.

Correction and corrective action

ISO 9000:2015 keeps the two apart. A correction removes the nonconformity you found. A corrective action removes its cause so it does not recur. Recalibrating the overdue gage is a correction. Changing the process that let it go overdue is a corrective action.

An answer needs both. A correction on its own leaves the cause in place, and nothing stops the same finding from returning.

ISO 9001 clause 10.2 lists the steps. React to the nonconformity by controlling and correcting it and dealing with the consequences. Evaluate whether action is needed on the cause, by reviewing the nonconformity, finding its causes and checking whether similar ones exist or could occur. Implement the action and review its effectiveness. Update risks and opportunities, or the quality management system, if needed. Keep records of the nonconformity, the actions and the results. ISO/IEC 17025:2017 clause 8.7 sets out the same steps for laboratories.

Correct it and check the extent

Fix the instance first. Calibrate the overdue gage, obtain the missing certificate or add the missing instrument to the register. Record the date and keep the evidence.

Then check the extent. The auditor saw a sample. Search the whole program for the same problem: every gage for overdue dates, every certificate from the same lab, every instrument of the same type. Clause 10.2 asks you to determine whether similar nonconformities exist, and the auditor will look for that search in your answer.

If the finding involves equipment that was overdue or out of tolerance while in use, the measurements it made are in doubt. Assess their impact as you would for any failed gage, and record the result.

What to do when a gage fails calibration

Find the root cause

The root cause explains why your system allowed the nonconformity, not who made the mistake. Keep asking why until the answer is something in the process you can change. The five whys and a cause-and-effect (Ishikawa) diagram are simple tools for this.

Be wary of causes that end at a person. Operator error, or a plan to retrain the technician, does not explain why the process let the error happen or go unnoticed. Training can be part of a corrective action. It is seldom the whole of one.

An example. A gage was found overdue at final inspection. Why was it overdue? It was not sent out on its due date. Why not? The due list was a spreadsheet that one person checked, and that person was on leave. Why did nobody else check it? No procedure named a backup. The cause is a due-date process with a single point of failure, and the corrective action has to change that process.

Examples of calibration findings

The table shows calibration findings an auditor can write and the shape of a good answer to each. It is not a ranking, and your own finding will differ in detail.

Examples of calibration findings, with the correction, questions for the root cause and possible corrective action
Finding	Correction	Questions for the root cause	Corrective action can include
A gage in use past its calibration due date	Take it out of use, calibrate it and assess what it measured while overdue.	How are due dates tracked, and who checks them? What stops an overdue gage from being used?	A due list reviewed on a fixed schedule with a named backup, and a status check at the point of use.
Calibration records with no as-found readings	Ask the lab for the readings if it kept them.	Do purchase orders ask for as-found data? Does anyone review certificates on receipt?	As-found and as-left data required on purchase orders, and a certificate review before filing.
An out-of-tolerance result with no impact assessment	Do the assessment now, for the whole period at risk.	Is there a procedure? Who is told when a gage fails?	A written out-of-tolerance procedure with a named owner, triggered by every failed calibration.
An outside lab not accredited for a calibration where accreditation is required	Have the instrument calibrated by a lab whose accreditation scope covers it.	How are calibration suppliers approved? Is the scope checked, or only the certificate?	Supplier approval that checks the lab's scope against each type of calibration you buy.
A gage used for product acceptance that is not on the register	Add it, calibrate it and assess the measurements it made.	How do instruments get onto the register? Are personal and customer-owned gages covered?	A register rule that covers every gage used for acceptance, whoever owns it, and a regular floor check against the register.
A calibration certificate with no measurement uncertainty or traceability statement	Ask the lab for a corrected certificate.	Was the requirement on the purchase order? Was the certificate reviewed on receipt?	Certificate requirements on the purchase order, and a review against a checklist before acceptance.
Calibration intervals with no documented basis	Document the basis for the current intervals.	Who sets intervals, and from what data?	An interval procedure that uses calibration history, with each review recorded.

Write the response

Your certification body sets the time allowed, and often the form. ISO/IEC 17021-1 requires it to ask you for the cause analysis and the correction and corrective action within a defined time, and the timeframe is agreed at the closing meeting. A clear response covers these points.

The nonconformity as written, with the requirement it cites.
The correction, the date it was done and the evidence.
The extent check: what you searched, what you found and what you did about it.
The root cause, with the analysis that led to it.
The corrective action, with an owner and a due date for each step.
How and when you will check that it worked.

Tip: Answer the finding that was written. A response that rewrites the whole calibration program for one overdue gage is harder to verify and harder to finish on time.

The evidence that closes a finding

The certification body reviews your correction, cause and corrective action, and it verifies that they worked. ISO/IEC 17021-1 allows that check on documents you send or, where needed, on site. The body tells you whether it needs another full or limited audit, or will confirm the evidence at a future audit.

Send evidence of the change, not a promise of it. For calibration findings that usually means some of the following.

The dated calibration record or certificate that corrected the instance.
The result of the extent check, such as a register report from that date with no other overdue gages.
The revised procedure, with its revision number and the change marked.
Training records for the people who work to the new procedure.
The impact assessment for any equipment that was in doubt.
Records from the weeks after the change that show the process working, such as completed due-list reviews.

Tip: ISO 9001 asks you to review the effectiveness of corrective action. Choose a measure that would show the problem coming back, and check it over a period long enough to mean something.

If you run a calibration or testing laboratory

A laboratory working to ISO/IEC 17025:2017 handles nonconformities, including those raised by an assessor, through clause 8.7. Clause 8.7.3 asks it to keep records of the nature of each nonconformity, its causes, the actions taken and their results.

When the finding concerns equipment or results, clause 7.10 on nonconforming work applies as well. The lab evaluates the significance of the work, including an impact analysis on previous results, and notifies the customer and recalls work where necessary.

ISO/IEC 17025 calibration requirements

How to answer a calibration finding, step by step

Read the requirement and the evidence, and make sure you understand the finding before the audit ends.
Correct the instance and keep dated evidence.
Search the whole program for the same problem and correct what you find.
Assess the impact on product if equipment was overdue or out of tolerance while in use.
Find the root cause in the process and write down the analysis.
Plan the corrective action with an owner and a date for each step.
Send the response within the time agreed with the certification body.
Carry out the action and collect the evidence.
Check over a set period that it worked, and record the result.

How Axiospec helps with calibration findings

Axiospec is calibration management software. It does not write corrective actions or decide when a finding is closed. Those stay in your quality system. It keeps the calibration evidence an auditor asks for in one place, so corrections and extent checks take less digging.

Each instrument carries its due date and its calibration history, with as-found and as-left readings, the reference standard used and the certificates. Records sit in a tamper-evident, hash-chained ledger. A mistake is fixed with a correction that needs a written reason, and the original stays on the record. A failed calibration puts the instrument in quarantine and asks for the out-of-tolerance impact.

The audit pack exports the register, the calibrations, the certificates and an audit summary in one archive, for every instrument or for one site, location or instrument. You can give an auditor read-only access that ends on a date you set.

The free plan covers up to 50 active instruments. A new workspace starts with a 45-day trial of Professional, with room for 1,500 active instruments and no credit card. We load your existing records for you at no charge on every plan.

Common questions

What is a calibration nonconformity?: It is a calibration requirement that was not met, found at an audit. The requirement can come from the standard, such as ISO 9001 clause 7.1.5, from a customer or from your own procedure. A gage used past its due date is one example. A failed calibration with no impact assessment is another.
What is the difference between correction and corrective action?: A correction fixes the nonconformity you found, such as calibrating an overdue gage. A corrective action removes the cause so the problem does not recur, such as changing how due dates are tracked. ISO 9000:2015 defines both, and an auditor expects to see both in your answer.
How do you write a root cause for an audit finding?: Ask why the process allowed the nonconformity, and keep asking until the answer is something in the process you can change. Write down each step of the analysis. Do not stop at a person, such as operator error, because that does not explain why the process let the error through.
What evidence closes a corrective action?: Records that show the change happened and works. That can be the corrected calibration record, the result of the search for similar problems, the revised procedure, training records and records from the weeks after the change. The certification body reviews them and may verify on site.
What is the difference between a major and a minor nonconformity?: Under ISO/IEC 17021-1, a major nonconformity affects the management system's ability to achieve its intended results, and a minor one does not. Several minor findings against the same requirement can add up to a major one. Before its decision, the certification body verifies the correction and corrective action for a major and accepts your plan for a minor.
How long do you have to respond to an audit finding?: Your certification body sets the time, and it is agreed at the closing meeting. ISO/IEC 17021-1 requires a defined time for the response. For a major nonconformity at an initial certification audit, the body must verify the correction and corrective action within six months after the last day of stage 2, or it runs another stage 2 audit before it recommends certification. Some schemes fix the deadline. Under the IATF rules for IATF 16949, the first response to a major nonconformity is due within 15 calendar days.

Put it into practice

Got a gage list? Send it over and we load it for you, usually in a couple of business days. Free on every plan. Then log every calibration to a tamper-evident audit trail and produce records on demand.

Create your account

Axiospec is a documentation and workflow tool. It helps you keep clean, traceable, audit-ready records. Certification depends on your own processes, scope and assessor.