ISO standards: Opportunities for improvement and non-conformities
The concepts of Opportunities for Improvement (OFIs) and Non-Conformities were first introduced in 1987 with the inaugural edition of ISO 9001 and gradually integrated into other ISO Standards. They have since become the norm for reporting on ISO audit outcomes, highlighting gaps in compliance and helping drive continual improvement forward. This blog explains everything you need to know about OFIs.
Table of Contents
Understanding OFIs
An OFI is not given to highlight a gap in compliance with the standard but rather as a ‘should consider’ point. It should be viewed as a suggestion from your auditor on how to enhance your management system. An analysis of the OFI should be conducted before the decision is taken on whether to implement it or not.
It is important to note that there is no obligation to implement an OFI; however, if the decision is negative, a business justification should be recorded for future reference and audits. This may be based on risk, cost, availability of resources, conflicting priorities, timelines, etc.
This decision will involve key stakeholders, including top management, the ISMS management team and any other relevant resource. The individuals involved must assess the benefits of the OFI and any potential impacts its implementation might cause.
The decision and rationale will then be documented and may be reviewed periodically, as circumstances could change. It may be appropriate do document and track OFIs within the organisation’s Continuous Improvement Plan.
Addressing an Opportunity for Improvement
Addressing an Opportunity for Improvement (OFI) is a way to demonstrate an organisation’s commitment to continual improvement. Continual improvement is essential, as a stagnant management system risks becoming outdated and ineffective, reducing its ability to adapt to potential challenges and requirements.
An auditor may perceive the failure to proactively deal with OFIs as a lack of commitment, potentially impacting an organisation’s audit readiness. It is wise to expect auditors to want to see evidence that previous OFIs have been properly managed in subsequent audits, and unaddressed issues may raise concerns and potentially influence the audit outcome.
On this basis, it is best to always document the progress of an OFI, even if the decision was not to implement the suggestion.
Understanding Non-Conformities
Non-Conformities are a partial or complete failure to fulfil a requirement of the standard, with the potential to create an information security risk to the business. Non-Conformities are separated into two categories: major and minor.
A complete failure will lead to a major Non-Conformity, with a partial failure leading to a minor one. Identifying and dealing with Non-Conformities will enhance an organisation’s information security posture and bring it closer to certification.
Importantly, an organisation can still certify if it receives one or more minor Non-Conformities up to the point at which the auditor rules that the number or collective severity of minor findings constitutes a major Non-Conformity: in other words, the Management System is not being managed as it should.
Let’s look at an example of how a Non-Conformity may occur in practice:
Most standards require that ‘The organisation shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its management system’.
An example of a minor Non-Conformity could be that the organisational internal issues are determined, but not the external issues. This would show that the requirement is partially fulfilled, thus leading to a minor Non-Conformity.
On the other hand, not determining both internal and external issues would be treated as a complete failure to comply with the related clause, leading to a major Non-Conformity being recorded.
Addressing a Non-Conformity
If a Non-Conformity is identified, a Root Cause Analysis (RCA) must be conducted and documented for audit support and improved compliance with the standard. It contributes to the corrective action process by identifying and addressing the causes of the Non-Conformity rather than only its symptoms, therefore aiming to prevent its recurrence.
It is essential to document the Non-Conformity, its causes (and potentially its symptoms), the actions taken and evidence that these were effective.
Dealing with a Non-Conformity means:
- a) Reacting to the Non-Conformity: by controlling and containing it and dealing with consequences.
- b) Evaluating the need for action(s), to identify and eliminate causes.
- c) Implementing corrective action(s), which must be appropriate to the effects of Non-Conformities.
- d) Reviewing the effectiveness of actions taken, thus ensuring that the corrective actions will prevent recurrence.
- e) Making changes to the ISMS, if necessary, to realign documentation and prevent future Non-Conformities.
Following these steps illustrates the Plan-Do-Check-Act approach, whereby Planning is about implementing and developing a plan for improvement. Doing considers implementing the plan on a smaller scale, testing its effectiveness. Checking is about evaluating results and analysing whether they achieved what was intended, and finally acting. If the change is successful, then implement it on a wider scale.
If an organisation is assigned a Non-Conformity or an OFI, it is good practice to add these to the Continual Improvement Plan (CIP), where owners must be assigned a target completion date, as well as tracking progress through to completion.
If a major Non-Conformity is discovered during an audit, the auditor may ask you to produce an action plan and document how you intend to address and fix the major Non-Conformity. You may be required to report on progress and completion.
It is worth noting that a major Non-Conformity does not mean the certification process is aborted but it will put a pause to proceedings: your certification will be placed on hold until the major Non-Conformity has been appropriately resolved. This may lead to a supplementary audit, either remote or onsite, depending on the nature of the Non-Conformity.
If the major Non-Conformity is not appropriately dealt with, this may prevent the organisation from being recommended for certification or re-certification.
Conclusion
To build and maintain a robust management system, effectively managing both Opportunities for Improvement and Non-Conformities is crucial. An organisation should consider implementing a Non-Conformity and Corrective Action Procedure to provide guidance to employees on how to manage OFIs and Non-Conformities.
Addressing and appropriately documenting both will only positively impact your management system, allowing it to evolve and improve. Although there may be negative connotations associated with OFIs and Non-Conformities, they ultimately will always aim to improve compliance and lead to a positive culture of continual improvement.
By integrating these principles into operations, organisations can ensure long-term success in terms of their management system and day-to-day processes.
Why choose Evalian for ISO audits and consultancy?
If you are thinking of gaining ISO accreditation, we’re here to help wherever you are on your decision path.
We can help with an initial workshop, carry out a full gap analysis, help you with integrating ISO 27001, support your ISO project or manage your management system for you.
View our ISO 27001 Consultancy service
