Raise and resolve a non-conformity

May not be enabled

Non-conformities may not be turned on for your workspace or plan. If you don't see it, contact your workspace admin.

The non-conformity register records findings — where something failed to meet a standard, procedure or requirement — surfaced by audits, inspections, incidents and reviews. Each finding gets a reference like NCR-0001 and carries its root-cause analysis, corrective actions and effectiveness check with it.

Find it under Governance → Non-conformities.

Raise a non-conformity

1. Go to Non-conformities and select Raise.
2. Enter the Title and a Description of what was found and why it’s a non-conformity.
3. Choose the Source — Internal audit, External audit, Certification audit, Inspection, Incident, Supplier review, Management review, Customer complaint or Self-identified.
4. For an audit source, choose the Standard — ISO/IEC 27001:2022, ISO 45001:2018, ISO 22301:2019 or PCI-DSS v4.0.
5. Add a Control reference if the finding cites a clause, such as A.8.24.
6. Choose the Grade — Major, Minor or Observation.
7. Set the Owner — leave it empty and it defaults to you.
8. Save with Raise.

Caution

Audit-sourced findings must cite a standard. Internal audit, External audit and Certification audit all require a Standard before you can save.

Note

The Source is fixed once the finding is raised — you can edit the title, description, standard, control reference, grade and owner afterwards, but not the source.

Investigate the root cause

1. Open the non-conformity and go to Root cause analysis.
2. Choose the Methodology — 5 Whys, Fishbone, 8D or Narrative.
3. Write the Root cause — the underlying reason the finding occurred.
4. Add any Contributing factors — up to 20.
5. Save with Save root cause.

Recording the root cause on a freshly-raised finding moves it to Under analysis. You can edit the analysis later.

Note

Suggest with AI is reserved for a future release and shows Coming soon for now — write the root cause yourself.

Track corrective actions

Add a corrective action with a Description, the person it’s Assigned to and a Due date that is today or later. Adding the first one moves the finding to Corrective action.

Each action runs Open → In progress → Completed → Verified, and flips to Overdue once its due date passes without being resolved. Cancel action retires one that no longer applies. An action counts as resolved once it is Completed, Verified or Cancelled, and the panel header tracks how many of the total are resolved.

Note

Separation of duties: the person assigned a corrective action can’t verify that same action — Verify is hidden for its assignee.

Verify effectiveness

Once every corrective action is resolved, verify that the fix actually held.

1. Go to Effectiveness verification.
2. Choose the Result — Effective, Partially effective or Ineffective.
3. Record the Evidence that confirms it.
4. Save with Record verification.

A verdict of Effective clears the finding to close. Partially effective or Ineffective loops it back for another round of corrective action — it can’t be closed until effectiveness is confirmed.

Caution

A Major finding can only be verified by an owner, admin or manager. And the verifier can’t be assigned any corrective action on the same finding.

An effectiveness review falls due 30 days after the last corrective action is resolved; the Review due sort brings the ones waiting on you to the top.

Close it out

Move the finding to Closed and give a Reason — closing always requires one. An Observation closes freely. A Major or Minor finding needs every corrective action resolved and effectiveness verified as Effective first; until then the Close button explains what’s outstanding.

A closed finding can be reopened back to Corrective action if new information arrives.

Linked records

A non-conformity raised automatically from an Incident, Audit, Management review or Supplier review carries a link back to its source, shown under Linked records. These deep-links open once that module ships.

Statuses to expect

Raised → Under analysis → Corrective action → Effectiveness review → Closed. An observation that needs no formal follow-up can close without the middle steps.

Report on the register

Reports covers open findings grouped by grade, source, standard or owner, your closure rate, the average time to close by grade, and recurring root causes — over a 30, 90 or 365-day window. Export the register itself with Export CSV or Export PDF.