Top 10 Nonconformities We See in SMEs (And How to Fix Them Fast)

Most audits don’t fail because a business is “bad”. They fail because the basics aren’t controlled.

And the frustrating bit? It’s usually the same handful of issues, again and again.

Here are the top 10 nonconformities we see in SMEs — across security, construction, cleaning and manufacturing — plus the straight-talking fixes that get you back in control fast.

1. Document control is a mess (wrong versions in use)

What auditors see: procedures with no version or date, staff using old templates, multiple copies in different folders.

Fix, fast:

• one source of truth (one controlled folder)
• version and date on every controlled document
• archive old versions so they can’t be used by mistake

2. No evidence of competence or training

What auditors see: “We trained them” but no sign-offs, no matrix, no refresh dates.

Fix, fast:

• simple training matrix (role vs required training)
• keep sign-off sheets or digital records
• set refresh dates for critical roles

3. Corrective actions don’t fix root cause

What auditors see: “fixed” actions that don’t stop the issue repeating.

Fix, fast:

• write the root cause in one sentence
• add a prevention step, not just a patch
• verify effectiveness after 30–60 days

4. Internal audits are missing or poor quality

What auditors see: audits not done, or tick-box audits with no findings.

Fix, fast:

• schedule audits quarterly as a minimum
• audit processes, not paperwork
• record findings, actions and follow-up

5. Management review isn’t happening (or has no outputs)

What auditors see: no meeting, or a meeting with no decisions, no actions, no evidence.

Fix, fast:

• one agenda template
• record decisions, actions and owners
• review KPIs, complaints, audits, risks and objectives

6. Risks and opportunities aren’t controlled

What auditors see: a risk assessment exists, but it’s generic and never updated.

Fix, fast:

• keep one live risk register
• update it when things change (new contract, new site, new supplier)
• assign owners and review dates

7. Calibration and maintenance records are missing

What auditors see: equipment used for measuring or testing with no calibration or maintenance evidence.

Fix, fast:

• list critical equipment
• set calibration and maintenance dates
• store certificates and records in one folder

8. Supplier and subcontractor control is weak

What auditors see: subcontractors used with no checks, no approvals, no monitoring.

Fix, fast:

• approved supplier list
• minimum checks: insurance, competence, accreditations
• review performance annually

9. Objectives exist but aren’t measured

What auditors see: objectives like “improve quality” with no metric, no target, no review.

Fix, fast:

• set 3–5 measurable objectives
• track monthly on a simple dashboard
• link actions to results

10. Records are incomplete or impossible to retrieve

What auditors see: evidence exists “somewhere” but can’t be found quickly.

Fix, fast:

• standard naming convention
• one folder per process
• monthly or quarterly subfolders

The quickest way to stop nonconformities coming back

If you want a simple rule: control the system, and the audit takes care of itself.

That means controlled documents, controlled records, controlled actions and controlled reviews.

How CAW Consultancy helps

We don’t do corporate fluff. We build audit-ready ISO management systems that staff actually use — and we keep them simple.

If you want us to sanity-check your system before your next audit, get in touch. We’ll tell you what’s missing, what’s overkill, and what to fix first.

Related reading

For more on keeping nonconformities from coming back, see how to run a management review that stops recurring problems, risk assessments that actually work, ISO 9001 in plain English and the ISO certification process step by step.