What the clause requires
When a nonconformity occurs, including one arising from a customer complaint, clause 10.2 sets out a sequence. First, react to it: take action to control and correct it and deal with the consequences. Then evaluate the need for action to eliminate the cause, so that it does not recur or occur elsewhere, by reviewing and analyzing what happened, determining the causes of the nonconformity and determining whether similar nonconformities exist or could potentially occur in other products, processes or areas.
With the cause established, the organization implements the action needed, reviews the effectiveness of the corrective action taken, updates the risks and opportunities determined during planning if necessary, and makes changes to the quality management system if that is what the analysis points to. The corrective action has to be appropriate to the effects of the nonconformity encountered: a small, isolated deviation can legitimately be closed with correction alone, provided the decision and its reasoning are recorded.
The most common confusion is between correction and corrective action. Reworking the part, replacing the product or redoing the service is correction: it fixes the effect on that one item. Changing the process, the work instruction or the device that allowed the error is corrective action: it removes the cause. The documented information retained has to show the nature of the nonconformity, any subsequent actions taken and the results of the corrective action itself.
What the auditor asks to see
- Record of the nonconformity with an objective description and the requirement that was not met
- Immediate correction recorded, showing what was done with the affected product or service
- Cause analysis using a method such as five whys or a cause and effect diagram, with a conclusion
- Corrective action with an owner, a due date and a clear link to the cause that was found
- Effectiveness review with the criterion defined beforehand and the result recorded afterwards
Where companies most often get it wrong
- Corrective action that is really only correction, such as rework the batch or train the operator, with no cause
- Root cause recorded as human error or lack of attention, which stops the analysis too early
- Effectiveness verified on the same day the action was implemented, before any evidence could exist
- Customer complaint handled outside the nonconformity process, so it never reaches the analysis
- Failing to check whether the same problem can occur on other products, lines or shifts
Example of a nonconformity
- Requirement
- ISO 9001, 10.2.1 d): review the effectiveness of any corrective action taken.
- Evidence
- Nonconformity report 2026-009, a weld crack, was closed on April 15, 2026 with the action retrain the welder; the effectiveness verification was recorded the same day as effective. In May 2026, report 2026-021 recorded the same defect at the same station.
- Finding
- The effectiveness of the corrective action was not genuinely reviewed, and the nonconformity recurred.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Does every nonconformity require corrective action?
No. The standard requires the organization to evaluate the need. Isolated, low-impact deviations can be handled with correction alone, as long as that decision is recorded. Recurrence or impact on the customer normally calls for corrective action.
What is the deadline for completing a corrective action?
The standard does not set one. The organization sets deadlines consistent with the severity. Certification bodies typically allow 30 to 90 days for the action plan responding to findings they have raised.
Can human error be a root cause?
It almost never is. The next question is why the process allowed the error to happen: no mistake-proofing device, an ambiguous instruction, overload, or inadequate training.