How to Execute the ISO 9001 Corrective Action Process in 6 Steps

Key Takeaways

• Corrective action under ISO 9001 means removing the cause of a nonconformity so it does not return, which goes further than fixing the defective part.
• A working process has six steps: contain and define, find the root cause, plan the action, carry it out, verify it worked, and close the record.
• Auditors look for evidence at each step, so every decision needs a dated, retained record.
• Closing a corrective action request without checking effectiveness is the most common reason the same finding returns at the next audit.

A quality manager who has just received a customer complaint or an internal audit finding usually asks the same thing: what does the standard want done, and in what order? A sound ISO 9001 corrective action process answers that with six steps, and each one leaves a record an auditor can follow from the first report to the final sign-off.

Many certified plants still work to ISO 9001:2015 during the transition to ISO 9001:2026, the current edition, so the clause references below cite the 2015 edition. The practical sequence of containing, investigating, acting and checking is the same one shops already use. For a view of what the standard covers and who uses it, ISO's own explanation of ISO 9001 is a good place to start.

Understanding Clause 10.2: The Mandate for Corrective Action in Manufacturing

Clause 10.2 of ISO 9001:2015 covers nonconformity and corrective action. It applies whenever something fails to meet a requirement, whether the source is a customer complaint, a supplier problem, an internal audit finding or a part that fails inspection on the floor.

The clause asks an organization to do several things in response to a nonconformity:

• React to the nonconformity by controlling it, correcting it and dealing with the consequences, which means the suspect product is contained and the customer is told when that is needed.
• Evaluate whether action is needed to eliminate the cause, by reviewing the nonconformity, determining its causes and checking whether similar problems exist or could occur elsewhere.
• Implement the action needed and review its effectiveness, so the plant can show the fix held up.
• Update risks and opportunities determined during planning, and change the quality management system if the investigation shows a gap.

The clause also requires documented information about the nature of the nonconformity, the actions taken and the results. That record is what an auditor will ask to see.

Did You Know? Clause 10.2 treats correction and corrective action as two separate things. A correction deals with the nonconformity itself, such as reworking a batch, while corrective action deals with the cause so it does not happen again.

Step 1: Immediate Containment and Clear Problem Definition

The first step is to stop the problem from spreading and to describe it precisely. A vague request that says "bad welds on line 3" gives an investigator nothing to work with, while a precise one names the part, the lot, the defect, the quantity, the date and who found it.

What you need at this stage is a short list of facts and a decision about the product:

1. The part number, lot or serial range, and the process step where the defect was found.
2. A description of the requirement that was not met, with the specification or drawing reference.
3. A decision on what happens to the suspect product: segregate, sort, rework, scrap or release under a documented concession.
4. A check on whether product that already shipped could be affected.

The common mistake is jumping straight to blame. A problem statement that names an operator rather than a condition sends the investigation in the wrong direction and teaches the floor to hide defects.

Step 2: Conducting Rigorous Root Cause Analysis

Root cause analysis is where most corrective actions succeed or fail. The standard does not prescribe a method. It only requires that causes are determined, so the choice of tool is the plant's own.

Several methods satisfy the requirement when they are used honestly:

• The 5 Whys works well for a single failure with a short chain of causes, because each answer becomes the next question until the team reaches something it can change.
• A fishbone diagram suits problems with many possible contributors, since it forces the team to look at machine, method, material, measurement, people and environment together.
• A fault tree or an eight-discipline report fits recurring or customer-driven problems where the buyer expects a formal structure.

Key Consideration: Stop asking "why" when the answer is something the plant can control and change. If the last answer is "operator error," the analysis is unfinished, because it has not asked why the process allowed that error.

The common mistake is stopping at the first plausible cause. Retraining an operator is easy to write down and rarely addresses a missing fixture, an unclear work instruction or a gauge that drifts.

Step 3: Developing and Assigning Targeted Corrective Actions

Once the cause is known, the plant decides what will remove it. Good actions are specific, owned by one named person and given a due date. They also match the size of the problem.

A useful action plan separates three kinds of work. Containment fixes the immediate defect. Corrective action removes the cause. Preventive thinking asks whether the same cause could affect other lines, products or sites, which is the "similar nonconformities" check the clause refers to.

An action such as "improve inspection" is too loose to verify. A stronger version says the plant will add a go/no-go gauge at the second operation, update the control plan, and brief both shifts, with a date and an owner for each task. The 12-point internal audit checklist for manufacturing plants shows the kind of questions an auditor later uses to test whether such actions are real.

The common mistake is assigning every action to the quality department. Quality should coordinate, but the people who run the process are the ones who can change it.

Step 4: Executing the Action Plan and Updating Documentation

This step is where the plan meets the shop floor. Each action is carried out, and each change to the way work is done is reflected in the documents people actually use.

Illustrative example: A fabricator finds that a recurring dimensional error comes from two shifts setting a fixture differently. The corrective action is a revised setup sheet with a photo of the correct position, a fixture stop that prevents the wrong setup, and a short sign-off for each operator on both shifts.

The common mistake is closing tasks on paper before the change is live. An auditor who walks to the workstation and finds the old instruction will question the whole record.

Step 5: Verifying Corrective Action Effectiveness Over Time

Clause 10.2 requires a review of the effectiveness of any corrective action taken, and this is the step plants skip most often. Completing the tasks proves the plan was carried out. It does not prove the problem is gone.

Effectiveness is shown with evidence collected after the change, over a period that fits the process. A weekly defect that disappears for several weeks is persuasive. A defect that occurs twice a year needs a longer watch, or a different kind of evidence such as a process capability study.

Plants commonly use a mix of the following:

• A defined review date set when the action is approved, so the check is scheduled rather than remembered.
• Trend data from the same source that raised the problem, such as the inspection log, the complaint register or the scrap report.
• A follow-up audit of the changed process, which confirms people are following the new method.

Important: The evidence for effectiveness must be retained as documented information. A verbal statement that "it seems to be fine" does not satisfy an auditor.

The common mistake is verifying on the same day the action is completed. A check made before the process has run long enough to show a result proves nothing.

Step 6: Closing the CAR and Updating the Risk Register

Closure is a decision, and it should be made by someone who was not responsible for the fix. The reviewer confirms the problem was defined, the cause was found, the actions were completed and the effectiveness evidence is in the file.

Closure is also the moment to ask what the event teaches the wider system. Clause 10.2 calls for updating risks and opportunities determined during planning, and for changing the quality management system when needed. If a failure revealed a risk that the plant had not recorded, the risk register should now carry it. If a procedure was missing, it is added.

A closed corrective action request should contain, at a minimum:

• A clear problem statement with dates, quantities and the requirement not met.
• The root cause analysis and the method used.
• The actions taken, with owners and completion dates.
• The effectiveness evidence and the name of the person who approved closure.

For a plant that wants a second opinion on whether its records would hold up, the free ISO readiness assessment is a practical place to see where the gaps are.

Common Corrective Action Pitfalls That Trigger Repeat Audit Findings

Certification bodies, which in Canada are accredited through the Standards Council of Canada, often see the same weaknesses when they review corrective action records. Knowing them in advance helps a plant avoid them.