Compliance vs Conformity: Why ISO Talks About Conformity

Compliance and conformity are often used as if they mean the same thing. In the ISO world they don’t, and the distinction is genuinely useful once it clicks. In a sentence: compliance is meeting a requirement imposed on you from outside (usually the law), while conformity is meeting a standard or set of rules you have chosen to adopt. It’s why an ISO audit will only ever raise a “nonconformity”, never a “non-compliance”.

Conformity: meeting a requirement you’ve adopted

ISO defines conformity as the fulfilment of a requirement, and a requirement as a need or expectation that is stated, generally implied, or obligatory. Inside a management system, those requirements are the standard itself (say ISO 9001), plus your own documented procedures and the customer requirements you’ve taken on. Meet them and you have conformity; fall short and you have a nonconformity (which your system then corrects).

The key point: conformity is measured against things you have chosen to adopt. You decided to implement the standard; you wrote your procedures. Conformity is about living up to your own arrangements.

Compliance: meeting something imposed from outside

Compliance is about obeying an externally imposed obligation, most often a legal or regulatory requirement, and sometimes a contractual one. You don’t get to opt out of the law the way you opt into a standard. Failing here is non-compliance, and the consequences flow from regulators, courts or a customer, not from your auditor.

An easy way to remember it: conformity is to something you’ve adopted; compliance is to something imposed on you.

Why ISO audits only raise “nonconformities”

An ISO auditor assesses your system against the standard and your own documented arrangements. That is conformity. They are not regulators, and they can’t rule on whether you have actually broken a law. So the findings of an ISO audit are always expressed as conformities or nonconformities (major or minor), never as “non-compliance”. If an auditor sees a potential legal breach, they’ll record it as a nonconformity against the part of the standard that required you to manage it, and leave the legal judgement to those whose job it is.

But ISO still cares about legal compliance

This is where the two ideas meet. The standards require you to identify and meet your legal obligations. ISO 9001 requires you to determine and meet applicable statutory and regulatory requirements; ISO 14001 goes further still, with explicit “compliance obligations” and a whole clause on evaluation of compliance; ISO 45001 does the same for safety. So if you have no process for keeping on top of the law, that gap becomes a nonconformity against the standard.

In other words, compliance (external) sits neatly inside conformity (to a standard that requires you to manage that compliance). Your management system doesn’t replace the law. It’s the machine that makes sure you keep meeting it.

The practical takeaway

Track your compliance obligations deliberately (our guide on managing compliance covers how to keep up with changing legislation) and let your management system give you demonstrable conformity to the standard wrapped around them. Get both right and you can prove, to a customer or an auditor, that you meet the requirements you’ve adopted and the ones imposed on you.

Speak with an experienced ISO auditor

If you’d like help building compliance and conformity into one practical management system, you’ll work directly with an experienced ISO auditor, and our systems are built to certify first time. Email hello@streamline.business, call Brisbane 07 3667 8280, Sydney 02 8315 7780 or Melbourne 03 9034 3990, or get in touch here.