The Definition of Non-Compliance

Definition of Non-Compliance

Non-compliance is a failure to meet a required regulatory standard, internal policy, contractual requirement or safety procedure. It can range from a minor paperwork gap, such as a missing training record, to a serious violation that puts workers at immediate risk, such as an unguarded machine. Regulators and auditors use the term to describe any deviation from what is legally or procedurally required.

In safety management systems such as ISO 45001, a similar term, nonconformity, is used for any failure to meet a requirement of the system, whether it comes from the law, the standard or the organization's own procedures. Whatever the term, the goal is the same: find the gap, understand why it exists, fix it and make sure it stays fixed.

Non-compliance matters for more than fines. It often signals that a hazard is not being controlled, and repeated gaps can show deeper weaknesses in supervision, training or resources.

Types of Non-Compliance

• Regulatory: not meeting the requirements of laws and regulations, such as OSHA standards, environmental permits or transport rules.
• Internal policy: not following the organization's own procedures, such as a permit-to-work system or a lone worker check-in policy.
• Contractual and client requirements: not meeting safety requirements set by clients, insurers or prime contractors.
• Management system: not meeting the requirements of a certified system such as ISO 45001.

Common examples

• Expired training or certifications. A training matrix helps prevent this.
• Missing or outdated written programs, such as hazard communication or lockout/tagout procedures.
• Missing machine guards or bypassed safety devices.
• Incomplete inspection records or overdue equipment checks.
• Injury logs that are incomplete or filed late.
• Workers not wearing required PPE.

OSHA Violations and Penalties

When OSHA finds non-compliance during an inspection, it may issue a citation. Common categories include other-than-serious, serious, willful and repeat violations, as well as failure to abate a previously cited hazard. Penalty amounts are adjusted for inflation each year, and willful or repeat violations carry much higher maximums. Where no specific standard applies, OSHA can cite a recognized hazard under the General Duty Clause.

Managing Non-Compliance

1. Find it: use internal audits, workplace inspections, gap analyses against current regulations and worker reports.
2. Assess the risk: fix immediate hazards first, and prioritize the rest by severity.
3. Find the cause: ask why the gap exists. Common causes include unclear procedures, lack of time or resources, poor training, and changes that were not managed. See incident investigation.
4. Correct it: assign a corrective action with an owner and due date.
5. Verify: check that the fix worked and has been kept in place.
6. Prevent recurrence: update procedures, training and management of change processes so the same gap does not appear elsewhere.

Repeated minor non-compliance should not be ignored. When gaps are tolerated, they can turn into accepted practice, a pattern known as normalization of deviance.

Example of Non-Compliance

During an internal audit, a manufacturing facility found that its lockout/tagout procedures had not been updated after three new packaging machines were installed. Operators had been using the old procedure for a similar machine, which did not cover a pneumatic energy source on the new equipment. No incident had occurred, but the site was out of compliance with OSHA's 29 CFR 1910.147.

The site wrote machine-specific procedures for each new machine, trained affected workers, and added a step to its equipment installation checklist requiring lockout procedures to be written before new machines are put into service. A follow-up audit three months later confirmed the procedures were in use.

Frequently Asked Questions: Non-Compliance

What is the difference between non-compliance and a violation?

Non-compliance is the broader condition of not meeting a requirement. A violation is what a non-compliance is called once a regulator such as OSHA has formally identified and cited it. All violations involve non-compliance, but not all non-compliance results in a citation.

What happens after non-compliance is identified?

The organization documents the gap, develops a corrective action plan with a timeline and owner, implements the fix and verifies that it worked. If found during a regulatory inspection, there may also be penalties, abatement deadlines or follow-up inspections.

Can an employee be held responsible for company non-compliance?

OSHA generally holds employers responsible for maintaining a compliant workplace. Employees can face internal discipline if they knowingly bypass safety procedures, and in rare cases of willful violations, individuals can face personal liability.

How do companies find non-compliance before an inspector does?

Regular internal audits, gap analyses, mock inspections, third-party reviews and compliance management software that tracks regulatory changes and overdue tasks.

Does non-compliance always mean something dangerous is happening?

Not necessarily. Some non-compliance is administrative, with no immediate safety impact, while other cases represent an active hazard. Either way, it should be corrected, since administrative gaps often signal weaker oversight elsewhere.