Auditor Raised a Major Non-Conformity? Close It the Right Way

Non-Conformity Closure: Root Cause & Corrective Action Help

Non-conformity closure means fixing the finding, proving the cause is gone, and getting the auditor to accept your evidence. For a major non-conformity, remove the threat at once, agree a corrective action plan with the auditor, and finish within the agreed time, normally three months. An additional audit then checks that it worked.

An auditor has just raised a major non-conformity against your company or your ship. The clock is running, and your certificate may be at stake. Our Document of Compliance (DOC) certification page explains that a major non-conformity can lead to DOC withdrawal. This page covers what to do next.

Legal Babu's marine team runs the root-cause analysis, writes the corrective and preventive action plan, and builds the evidence file for your flag, RO or class. Your team leads the fix and the audit conversation. We make sure both stand up when the auditor returns.

What Is a Non-Conformity in an ISM Audit?

A non-conformity is a situation where objective evidence shows that a specified requirement was not met. The requirement can come from the ISM Code, your flag or your own safety management system (SMS). Objective evidence means facts anyone can check, such as records, observations and test results. A hunch does not count.

Auditors sort ISM audit findings into three grades. The grade decides how fast you must act. For background on how the Code came about, see the IMO's safety management page.

Practical insight: Ask the auditor to name the exact requirement behind each finding. A finding without a clear requirement is hard to answer. A finding with one tells you what your response must prove.

What Is the Difference Between an Observation and a Non-Conformity?

Ask one question. Did the auditor find proof that a requirement was missed? If yes, you have a non-conformity. If the auditor spotted a weak point that could cause trouble later, you have an observation. The IACS audit procedure describes observations this way, and IACS member societies follow it.

Treat observations as early warnings. A weak point nobody fixes tends to harden into a non-conformity at the next audit.

What Happens When an Auditor Raises a Major Non-Conformity?

Things move fast. At the end of the audit, the team meets senior management and presents the findings. IMO's 2023 guidelines for administrations (Resolution A.1188(33)) expect that closing meeting. The flag or RO then follows IMO's procedures for major non-conformities (MSC.1/Circ.1059-MEPC.1/Circ.401). In practice, the path looks like this:

1. Remove the serious threat. A major non-conformity needs immediate corrective action. Fix the unsafe condition first. Record what you did, when and who did it.

2. Ask for a downgrade. The flag or RO may downgrade the major to a non-conformity once it is satisfied that effective corrective action is under way. For a major raised on a ship, that downgrade should come before the ship sails.

3. Agree the schedule. The rest of the corrective action should finish within an agreed schedule that does not exceed three months.

4. Finish the work and book the follow-up. Complete each action and apply for the additional audit as agreed.

5. Pass the additional audit. At least one additional audit checks that your actions worked.

If the flag or RO is not satisfied at any point, it can withdraw the certificate. That is the moment an audit finding becomes a business problem. Failing to take adequate corrective action, including measures to prevent recurrence, may also be treated as a major non-conformity on its own.

What Happens If the DOC or SMC Is Withdrawn?

IMO's procedures set out the consequences.

• No interim certificate. A company whose DOC was withdrawn should not get an interim DOC. A ship whose Safety Management Certificate (SMC) was withdrawn over a major non-conformity should not get an interim SMC.

• Full re-verification. A new DOC needs an initial verification, or an additional verification of the same scope. The new DOC should carry the same expiry date as the withdrawn one.

• Ships follow the company. When SMCs fall with the DOC, new ones wait until the DOC is back and the flag has verified at least one ship of each type at initial scope.

• Ships stop trading. A ship with a valid-looking SMC but a withdrawn company DOC must not operate until the DOC is reissued. The flag or a port State may detain the ship or revoke its operating permits.

Indian-flag note: DGMA's older ISM instructions (M.S. Notice 08 of 2004) add three points for Indian-flag companies and ships:

• If majors are raised at an annual DOC or intermediate SMC audit, endorsement waits until the findings are dealt with and closed.

• Downgrading a major so that endorsement can go ahead needs prior approval from DGMA.

• The RO must send a detailed report on the circumstances behind every major with the audit report.

These notices date from 2004, and DGMA has issued later ISM circulars. Confirm the current position with DGMA or your RO.

How Long Do You Have to Close a Non-Conformity?

Normally up to three months. IMO's guidelines say corrective action should not normally take longer than three months, and follow-up audits must happen within the agreed time. DGMA's instructions use the same three months for Indian-flag audits, counted from the date of the non-conformity notice. Our DDOC certification guide explains that a DDOC non-conformity left open past three months can be treated as a major.

A shipboard major follows a faster rule, because it should be downgraded before the ship sails.

Three months is a ceiling, so plan backward. The auditor still needs a slot for the follow-up visit, and the flag or RO still needs time to review your file. We tell clients to finish the evidence well before the deadline.

What Should You Do in the First Week After the Audit?

Use this sequence. It is Legal Babu's working method, not a regulatory list.

1. Get the finding in writing. Check the clause cited, the ship or office, the date and the evidence the auditor saw.

2. Brief top management and the DPA the same day. A major non-conformity reaches the whole company, so leadership should hear it from you early.

3. Contain the risk. Make the immediate fix and note when, who and how.

4. Check the facts. Pull the logs, records and emails the auditor reviewed. Make sure your version matches theirs.

5. Look for the same gap elsewhere. Sister ships, other departments and the shore office often share the weakness.

6. Ask how the auditor wants the response. Confirm format, deadline, recipient and whether an additional audit is planned.

7. Start the root-cause analysis. Include the people who do the work, from masters and chief engineers to the superintendent who approves spares.

Practical insight: Hold off on rewriting the procedure on day one. A fast rewrite often fixes the wrong thing, and then you rewrite it again.

How Do You Run Root-Cause Analysis After a Ship Audit Finding?

The ISM Code already asks for root-cause thinking. Section 9 expects your SMS to include procedures to report, investigate and analyse non-conformities, and to apply corrective action that includes measures to prevent recurrence. Section 10 adds that maintenance non-conformities should be reported with their possible cause. Auditors look for that thinking in your response.

Use these steps.

1. State the finding in one sentence. Name the requirement and the evidence.

2. Collect facts. Pull logs, records, emails and interview notes. Leave opinions out.

3. Ask why until you reach something you can change. Five rounds is a guide. Stop when the answer points to a gap in your system that you can fix.

4. Check both ends. Look at the ship and the shore office. In our experience, the cause often sits ashore: a late purchase approval, an unclear role, a form revision that never reached the ship.

5. Check human factors. Look at workload, rest hours, language, training and supervision.

6. Check how far it spreads. Test sister ships, other departments and other ship types.

7. Write one clear cause statement per finding. If you cannot verify it, keep digging.

Weak cause statements get rejected. Strong ones point to a fix.

A typical case (illustrative). An annual DOC audit finds the overhaul of an emergency fire pump overdue on two ships. The first draft response blames the chief engineers and promises a reminder email. Root-cause work tells a different story. The jobs stalled because spares waited for one superintendent's approval, and nobody covered during leave. The real fix is a backup approver, an escalation rule in the planned maintenance system and a monthly overdue-critical-items report to the DPA. The reminder email stays, but it becomes the smallest part of the answer.

Mistakes that sink a root-cause analysis:

• Stopping at "human error."

• Using retraining as the only action.

• Fixing only the ship named in the report.

• Writing a cause nobody can verify.

• Skipping the effectiveness check.

What Is the Difference Between Correction, Corrective Action and Preventive Action?

Teams mix these up, and auditors notice.

• Correction fixes the problem in front of you. Example: complete the overdue overhaul and record the test result.

• Corrective action removes the cause so the problem does not return. The ISM Code ties corrective action to measures that prevent recurrence.

• Preventive action removes the cause of a problem that has not happened yet, such as the same weak approval step on other ships.

• Effectiveness check shows the change works, for example three months of clean overdue reports.

You may meet the term corrective and preventive action, or CAPA, in older quality documents. ISO 9001, ISO 14001 and ISO 45001 all deal with nonconformity and corrective action in clause 10.2. Their current editions fold preventive thinking into risk-based thinking instead of a standalone clause. If your company holds ISO 9001, ISO 14001 or ISO 45001, you already run a clause 10.2 process. Our Integrated Management System (IMS) consultancy page explains how to combine systems. An ISO certificate does not replace ISM Code compliance, so keep ISM findings in a register your DPA owns.

What Goes Into a Corrective Action Plan?

A good plan reads like a work order. Each line says who does what by when, and how you will prove it.

1. The finding reference and the requirement cited.

2. A short, factual description of what happened.

3. The correction you made and its date.

4. The root-cause statement.

5. Each corrective action, with one named owner.

6. Preventive actions for other ships, ship types or departments.

7. Target dates that sit inside the agreed deadline.

8. The evidence you will attach for each action.

9. How and when you will check effectiveness.

10. Sign-off by the DPA or top management.

Practical insight: Pick owners who survive crew changes. A master leaving next month makes a weak owner for an action that needs three months. Give shore actions to the superintendent or DPA, and let the master support them.

What Evidence Will an Auditor Accept to Close a Finding?

The auditor wants proof that the fix exists and works. Match the evidence to the finding.

Four rules apply to every file:

• Date records truthfully. Never backdate or invent a record to cover a gap. If a record was missed, say so, explain how you rebuilt the facts and fix the process.

• Show the fix works. Two or three months of clean records after the change say more than a new procedure alone.

• Label every attachment. An annex index saves the auditor time.

• Date-stamp photos and screenshots.

How Do You Write the Closure Response?

Tone matters as much as facts. Auditors expect a response that goes finding by finding. Each one should cite the requirement, state the facts, name the cause, list the actions and point to the evidence. Leave out excuses and blame. Leave out promises you cannot keep.

Here is a short illustrative extract. The vessel, dates and numbers are made up.

• Finding 1, ISM Code section 10: Planned maintenance on the emergency fire pump of MV Example was 41 days overdue.
  
• Correction: The overhaul finished on 12 March. The test record is in Annex A.
  
• Cause: The spares requisition waited five days because the only approver was on leave. The maintenance system flagged the job but had no escalation step.
  
• Corrective action: A backup approver now covers leave (Annex B). The system escalates overdue critical jobs to the superintendent after seven days (Annex C).
  
• Preventive action: We reviewed all ships and closed two similar overdue items (Annex D).
  
• Effectiveness check: The DPA reviews the overdue-critical report monthly for three months. The first report is in Annex E.

Send the response to the person or office the auditor named, such as the RO office or the flag's ISM office. Keep a copy and proof of delivery.

Can You Challenge a Finding You Disagree With?

Yes, if the facts or the requirement do not support the finding. Raise it at the closing meeting and bring evidence. Under DGMA's older ISM instructions, a company that disagrees with an auditor's findings can appeal through its designated person to the Chief Surveyor with the Government of India. Confirm that route is still current before you use it.

Pick your battles. Dispute a finding when the requirement does not apply or the evidence is wrong. Do not dispute to buy time. Also ask the auditor whether the closure deadline keeps running during a dispute, and assume it does.

How Does Non-Conformity Closure Work for ISPS and MLC Findings?

The closure logic matches ISM: find the cause, fix it, prove it. The wording and the certificate at risk change.

For ISPS findings, the flag decides which changes to an approved Ship Security Plan need approval before use. Check this before you rewrite a security procedure as your fix.

For MLC findings, the ILO states that a Maritime Labour Certificate must be withdrawn when a ship does not comply and the required corrective action has not been taken. 

Our MLC 2006 certification page covers the certificate itself. Our guide to the interim maritime labour certificate helps if your ship is still at the interim stage. Manning agencies face similar closure work under MLC Regulation 1.4, RPSL annual compliance and RPSL license cancellation rules. Start with our RPSL license page for the basics.

How Do You Stop the Same Finding From Coming Back?

A closed finding that returns costs more than the first one. Build the fix into the system.

• Update the SMS. If the cause sits in a procedure, change the manual and the forms. Our SMS manual preparation service does this for ship managers.

• Test it before the auditor does. The ISM Code requires internal audits on board and ashore at intervals not exceeding twelve months. Run a targeted internal audit on the fixed area. Our DOC audit preparation service includes gap analysis and corrective action follow-up.

• Keep one finding register. Log findings from internal audits, external audits, port State control and charterer inspections in one place. Our SIRE 2.0 guide for ship managers shows how negative observations are coded and re-checked.

• Use one risk method. ISO 31000 risk management gives your DPA a common approach for assessing risk across ships.

• Cover special topics. For cyber risk findings, a cyber security audit can support your evidence. If a supplier caused the lapse, our vendor assessment service can review them.

• Mind class and flag. Class surveys and ISM audits ask different questions, yet a class finding can reveal a maintenance gap. Our IACS classification societies guide and condition surveys page cover the physical side. If you plan a flag change, read our guide to registering a vessel under the Indian flag.

What Will Legal Babu Do for Your Non-Conformity Closure?

Our marine team of Master Mariners and Chief Engineers brings seagoing and shore audit experience to your finding. Here is how we work:

1. Report review. We read the audit report and your closing meeting notes. We sort each finding by grade and requirement.

2. Root-cause analysis. We work with your DPA, masters, chief engineers and superintendents to trace each cause to something you can change.

3. Corrective and preventive action plan. You get owners, dates and the evidence each action needs.

4. Evidence file. We check your records against the plan and flag gaps early. We never create or backdate records.

5. Response drafting. We write the closure submission for your flag, RO or class in the language auditors expect: finding by finding, requirement cited, facts first.

6. Follow-up. We track actions to closure and help you prepare for the additional audit.

7. System fix. Where the cause sits in your manuals, we update the SMS through our SMS manual service.

Where we stop: Your company carries out the fixes and keeps honest records. The flag, RO or class decides whether to close a finding or keep a certificate. We cannot promise an outcome, and your team leads the conversation with the auditor.