Home › ISO Knowledge Hub › Nonconformity & Corrective Action
Nonconformity & Corrective Action
An evidence led guide to moving from immediate containment and correction to cause analysis, proportionate corrective action, effectiveness verification and defensible case closure.
Distinguish a detected nonconformity from its correction and from actions intended to prevent recurrence. Use the examples, process map and evidence matrix to strengthen real operating controls, not simply complete a form.
01. Nonconformity, Correction and Corrective Action: Three Different Concepts
The three concepts describe different questions: What requirement was not fulfilled? What fixes or controls the detected issue? What addresses its cause to reduce recurrence? They should not be conflated in a corrective action record.
A nonconformity needs an objective requirement and evidence of non fulfilment. A correction addresses the detected situation; containment limits immediate impact. A corrective action, when needed, addresses relevant causes and seeks to prevent recurrence or occurrence elsewhere.
- NC: Identify the unmet requirement, event, date, location, scope and evidence.
- Correction: Restore conformity where feasible, such as rework, replacement or record completion.
- Corrective action: Revise an ineffective control, competence arrangement or process to deal with the contributing cause(s).
- Proportionality: Evaluate whether further action is needed, considering consequences, potential recurrence and other similar cases.
NC Nonconformity
Meaning: A requirement has not been met.
Example: A final inspection reveals a product dimension outside the specified tolerance.
FIX Correction
Meaning: Action addressing the detected nonconformity.
Example: Segregate affected units and rework or reject them after evaluation.
CAUSE Corrective Action
Meaning: Action addressing the cause(s) to avoid recurrence.
Example: Strengthen machine setup verification after investigating repeated dimension drift.
Important clarification
Containment may be urgent, but it is not synonymous with correction or corrective action. The sequence of correction and investigation can vary with the type of problem; the response should fit the risk, evidence and relevant standard requirements.
02. From Nonconformity to Verified Closure: Practical Lifecycle
Use a traceable workflow to separate urgent response, investigation and assurance. This is an illustrative management approach, not a mandatory universal ISO sequence; some activities may be performed in parallel or reordered to protect safety, product integrity or evidence.
Define the unmet requirement, event and factual evidence.
Protect customers, people, outputs and ongoing activities as appropriate.
Restore conformity or manage the consequence where practicable.
Determine contributing causes and assess the need for wider action.
Specify corrective actions, responsible owners, dates and success measures.
Put controls into operation and retain completion evidence.
Use objective evidence over an appropriate period to test results.
Approve closure or reopen when evidence does not support effectiveness.
Decision gate: When is further corrective action needed?
- Assess the nature, significance and consequences of the event; consider whether similar issues exist elsewhere.
- If a cause related action is needed, record the basis, owner, due date and intended result.
- If no further action is appropriate under the applicable requirements, document the rationale and correction/containment evidence.
- Do not use a closed form as evidence of effectiveness when actual process performance has not been verified.
03. Containment and Immediate Response
Control the immediate risk first. Containment protects affected outputs or stakeholders while facts are gathered; it should be clearly time bound, owned and linked to follow up decisions.
ISOLATE Protect affected outputs
Identify lots, deliveries, records, services or work areas potentially affected. Segregate, suspend or otherwise control as appropriate to the situation.
ASSESS Understand consequences
Determine whether there are customer, safety, environmental, information security, statutory, contractual or other impacts and escalate as required.
RECORD Make decisions traceable
Capture the detection method, affected scope, immediate steps, communication decisions and evidence before items or records are altered.
Containment is not closure
For example, holding a suspect batch prevents shipment but does not explain why the defect arose. The investigation should examine both the origin of the problem and the controls that failed to detect or prevent it.
04. Root Cause Analysis: Evidence Before Assumptions
A convincing cause statement explains the mechanism linking the issue to an underlying process weakness. “Human error” or “staff need retraining” may describe an event or proposed solution without establishing the system cause.
- Define the problem: Requirement, actual result, deviation, time and location.
- Collect evidence: Logs, samples, interviews, equipment data and change history.
- Test causal hypotheses: Distinguish contributing factors from coincidence.
- Look for common causes: Consider similar sites, shifts, equipment, suppliers or products.
- Select a fit for purpose tool: Use 5 Whys, fishbone, fault tree, process mapping or trend analysis where appropriate.
Example: Simplified 5 Whys
- Observed NC: Components repeatedly exceed a dimensional limit.
- Why? Machine settings drift during a production run.
- Why? Routine setup verification is inconsistently performed.
- Why? The control plan lacks a defined check frequency and accountability.
- Cause hypothesis: Setup verification is inadequately designed and monitored; confirm against records and measurements.
Avoid the common RCA traps
Do not stop at the first plausible cause; blame individuals without evidence; select retraining as the default response; use 5 Whys as a ritual; or close an action without linking it to verified operational results.
Related analysis: The Most Common Root Cause Analysis Errors →
05. Corrective Action Register: Owner, Due Date and Measurable Outcome
A useful register connects the nonconformity to its consequences, causal evaluation, corrective action, accountability, implementation evidence and effectiveness result. The entries below are illustrative fictional examples; their dates are not ISO deadlines.
On smaller screens, swipe sideways to view all table columns.
| NC / issue | Containment / correction | Cause & corrective action | Owner / due | Status & evidence | Review plan |
|---|---|---|---|---|---|
| NC-01 Dimensional defect | Segregate affected lot; review product already released. | Cause: Setup check not consistently defined. Action: Revise setup verification; independent first off check. | Production Manager 15 Nov 2026 | Implemented revised work instruction and first off check records. | Pending representative dimensional trend review. |
| NC-02 Missing training sign off | Identify affected operators and review competence records. | Cause: Record ownership unclear. Action: Assign record owner and establish periodic review. | HR / Process Owner 22 Nov 2026 | In progress owner assigned; record review plan initiated. | Planned sample of competence records across shifts. |
| NC-03 Repeated supplier delay | Notify affected customer; adjust delivery plan. | Cause: Escalation threshold not applied. Action: Define trigger and supplier performance review. | Supply Chain Lead 30 Nov 2026 | Planned escalation process being approved. | Scheduled review of on time delivery trend. |
What an accountable action record needs
- A unique NC identifier and traceable requirement/evidence reference.
- Named action owner and reviewer; due date based on risk and achievable verification.
- Description of correction, causal analysis, corrective action and cross process considerations.
- Implementation evidence, planned effectiveness criteria, review date and actual result.
06. Implement Actions and Retain Objective Evidence
“Action complete” should mean the planned change has been implemented and recorded. It should not automatically mean the change has prevented recurrence. Keep those decisions and dates distinct.
CONTROL Change the operating system
Update process controls, work instructions, inspection criteria, equipment checks, system permissions or supplier management where the evidence supports such changes.
OWNERSHIP Make accountability explicit
Assign an accountable owner, resources, implementation milestones, verification responsibility and any cross functional approvals.
EVIDENCE Prove implementation
Retain revised procedures, logs, training/competence evaluations, validation results, change approvals and a record of actual implementation.
Examples of implementation evidence
- Revised setup control plan and approved version history.
- Completed machine first off verification records.
- Operator competence checks tied to revised work.
- Process trend data and independent sample inspection.
07. Effectiveness Review: Did the Change Work?
Evaluate whether the selected action has addressed its intended cause(s) and reduced the likelihood of recurrence, rather than checking only that documents were revised or employees attended training.
CRITERIA Agree success measures
Define objective indicators before closing: Stable process capability, no repeat finding over representative cycles, fewer escapes or consistent control execution.
TIMING Allow enough operating evidence
Choose a review point based on production frequency, exposure, risk and the time needed for meaningful performance data; no universal 30/60/90-day period applies.
DECISION Record the verification outcome
Retain the sample or trend, reviewer independence where appropriate, conclusion and decision to close, continue monitoring, revise the action or reopen.
When the action does not work
Reassess the cause hypothesis, consider whether related activities were missed, implement revised control measures and schedule a new effectiveness review. A delayed or negative result is useful management information, not a reason for cosmetic closure.
08. Case Closure and Lessons Learned
A defensible closure decision links the reported NC with the actual response and supporting evidence. Closure authority and retention arrangements should be defined by the organization and applicable requirements.
On smaller screens, swipe sideways to view all table columns.
| Closure check | Evidence to retain | Reviewer question |
|---|---|---|
| Correction and consequences | Containment log, rework/disposition records, stakeholder notification | Were the immediate problem and consequences managed? |
| Cause and action evaluation | Cause analysis, supporting evidence, rationale for needed actions | Was the causal reasoning proportionate and supported? |
| Implementation | Approved updated controls, training/competence, system or equipment records | Did the planned action actually enter daily work? |
| Effectiveness | Trends, audit samples, monitoring results and signed verification | Does performance show the intended cause related improvement? |
| Learning and follow up | Cross site alerts, management review input, recurrence/reopen decision | Were systemic implications addressed and lessons shared? |
A clean closure statement
“The affected batch was contained and dispositioned; setup verification controls were revised and applied; records from subsequent representative production cycles confirm stable results against the agreed criteria. The owner and verifier approved closure, with any outstanding monitoring assigned.” This is an illustrative narrative, not a mandatory ISO form.
09. Practical Case Study: A Dimensional Nonconformity
Illustrative manufacturing scenario: Final inspection found machined parts outside the customer’s specified dimensional tolerance. The team distinguished urgent product control from the longer term action needed to prevent the same defect.
DETECT Finding and immediate response
The affected lot was identified, segregated and assessed for possible escapes. Shipment decisions were controlled while earlier lots were reviewed.
CAUSE Investigation and corrective action
Process evidence showed inconsistent machine setup checks and no defined verification accountability. Controls were revised and staff competence confirmed.
VERIFY Effectiveness and closure
The team sampled setup records and dimensional results across representative production runs. Closure was based on reviewed evidence rather than procedure issuance alone.
Why this is more than a “retrain the operator” response
The actions addressed the process control design and its execution, not only the person who was operating the machine. The example illustrates a possible causal chain; an actual investigation must establish its own evidence.
10. Corrective Action & Audit Evidence Matrix
Use this matrix to make each step auditable without turning routine problem solving into excessive paperwork. Auditors need traceability between the requirement, evidence, decisions and demonstrated result.
On smaller screens, swipe sideways to view all table columns.
| Lifecycle stage | Typical records / evidence | What an auditor can test |
|---|---|---|
| Identify NC | NC description, source, requirement, sample, evidence | Can the evidence show non fulfilment of a defined requirement? |
| Contain / correct | Product disposition, communication, temporary controls, service recovery | Did the response manage immediate consequences and affected scope? |
| Evaluate cause | Investigation notes, cause validation, related event screening | Does the reasoning connect evidence and potential recurrence? |
| Plan and implement | Approved action, assigned owner, milestones, revised controls, training | Was the planned change implemented, owned and applied? |
| Verify effectiveness | Monitoring data, repeated samples, outcome against success criteria | Is there objective evidence that the action worked? |
| Close and learn | Review sign off, residual issues, lessons shared, follow up trigger | Was the closure decision justified and retained? |
Evidence should match actual risk
The complexity of the record should fit the impact, frequency, regulatory exposure and operating context. A simple isolated issue may require fewer records than a recurring multi site or safety critical NC.
11. Frequently Asked Questions
Common questions from process owners, internal auditors and ISO implementation teams.
What is the difference between correction and corrective action?
Correction addresses the detected nonconformity or its immediate effect. Corrective action addresses its cause(s), when needed, to prevent recurrence. Some responses involve both activities.
Does every nonconformity require a full 5 Whys investigation?
No single root cause technique is required for every issue. Evaluate the need and depth of cause related action against the applicable standard, significance, risks and likelihood of recurrence.
Can containment and correction occur before root cause analysis?
Often yes, especially when immediate safety, product or customer consequences need control. Other situations may require cause analysis before selecting a safe or effective correction.
Who should own a corrective action?
Assign an accountable person with authority and access to the affected process; distinguish action ownership from the person who independently reviews effectiveness where appropriate.
Is there a mandatory ISO deadline for CAPA closure?
There is no single universal deadline applicable to every NC under every ISO management system standard. Plan and justify timing against risk, applicable requirements, customer commitments and evidence needed.
When is a corrective action effective?
When objective evidence supports that the intended cause related change works in actual operation, with an appropriate evaluation of recurrence or related performance indicators.
Can a record be closed when actions are complete but results are not yet demonstrated?
Avoid claiming verified effectiveness prematurely. Follow the organization’s defined process and applicable requirements; retain open follow up or monitoring until evidence supports the closure decision.
What if the same issue occurs again?
Review the earlier cause hypothesis, the implementation and coverage of controls, and whether similar conditions exist elsewhere. Reopen or initiate further action as appropriate.
Does “human error” count as a root cause?
It may describe an immediate mechanism but often needs further investigation of competence, workload, process design, tooling, information, supervision or system controls before concluding.
What records should an auditor expect?
Sufficient records to trace the issue, affected requirement and evidence, response, evaluated cause, actions taken, effectiveness review and authorized closure, proportionate to the situation.
12. Official Sources, Further Reading & Next Steps
Confirm terminology and evidence expectations against the applicable standard and use the related practical articles for deeper treatment of investigation, monitoring and independent closure review.
Primary ISO and ISO/IAF references
- ISO 10009:2024: Quality tools and their application: ISO published overview of tools supporting problem solving and effectiveness.
- ISO 9001 Auditing Practices Group: Nonconformity: Review and Closing (PDF): Informative auditing guidance, not a replacement for standard requirements.
- ISO/TS 37008:2023: Internal investigations of organizations: Additional context for structured investigations.
- ISO: Standards: Confirm the current edition of the relevant standard before applying requirements.
Related Knowledge and ISO Articles
RCA The Most Common Root Cause Analysis Errors →
Avoid premature conclusions, weak causal chains and solutions selected before validation.
VERIFY How to Verify That a Corrective Action Is Effective →
Translate closure decisions into objective monitoring and evidence.
EVIDENCE What to Record in a Useful Nonconformity Report →
Connect findings, facts, scope and accountable follow up in a usable record.