What is corrective action?

What it is

Clause 10.2 sets out what you do after something fails. React to it and control it. Evaluate whether action is needed to eliminate the cause, by reviewing the nonconformity, determining its cause, and checking whether similar ones exist or could occur. Implement the action. Review its effectiveness. Update risks and the system if needed. Keep records of both the nonconformity and the results.

The steps that get skipped are the second and the fourth: determining the cause, and reviewing effectiveness. Most weak corrective action reports have a thorough description of the problem, an immediate fix, and nothing in between or after.

Note what the clause does not require: a specific method. Five whys, fishbone, 8D, and a paragraph of clear reasoning are all acceptable if they actually reach a cause. Aerospace and automotive customers often impose a method of their own on top.

When you will hear it

After every audit, internal or external, as the response mechanism for findings.

From a customer, as a corrective action request, usually with their own form and their own deadline, and often stricter than your registrar's.

In the phrase CAPA, which comes from the medical device and pharmaceutical world. ISO 9001:2015 does not use it: preventive action was folded into risk-based thinking in clause 6.1.

What the auditor expects to see

A record that separates correction from corrective action. What you did about this instance, and what you did about the cause.

Evidence of the causal reasoning, however short, that a reader can follow from the symptom to the mechanism.

Extent-of-condition thinking: did you check whether the same problem exists on the other line, the other shift, the other product?

Verification with a date and a method. Not "closed", but what was examined afterward and when, to show the action worked.

Common mistakes

Retraining as the universal answer. Retraining is valid when the cause is a competence gap. When the cause is an ambiguous work instruction or a process that makes the error easy, retraining postpones the recurrence.

Closing everything on the deadline. A batch of actions all closed the day before the response is due tells the auditor how they were produced.

Treating the finding as the problem. The finding is a symptom the auditor happened to see. The problem is the process that produced it.

No effectiveness check. The most common gap, and the one that turns this year's minor into next year's repeat.

FAQ

How long do we have?

Registrars typically require a response plan quickly and full closure inside 60 to 90 days for a major. Minors are usually reviewed remotely against a plan and a commitment date. Customers set their own clocks, often shorter.

What is the difference between correction and corrective action?

Correction fixes the instance: sort the batch, re-issue the document. Corrective action removes the cause so it does not happen again. The clause requires both, and auditors check that you can tell them apart.

Does ISO 9001 still require preventive action?

Not as a separate clause. The 2015 edition replaced it with risk-based thinking in clause 6.1, which asks you to plan for what could go wrong rather than react after it does.

What happens if a corrective action fails?

The finding recurs, usually at the next audit, and repeat findings escalate. That is why the effectiveness review is a requirement and not a formality.