Clause 10.2, nonconformity and corrective action: what passes and what gets reopened
Written from the auditor's side of the table. Clause numbers are pointers; the wording is ours, not the standard's. Last checked against the published ISO 9001:2026 text: October 12, 2026.
A corrective action that was completed is not the same as one that worked. Under the 2026 edition the auditor's question is whether the organization checked that the cause is gone, and the most common finding is a closed action with no evidence that anyone looked. This page is what gets asked, in order.
The four questions an auditor asks about any closed CAPA
- What happened? A problem statement with what, where, when, who and how much. "Customer complaint" is a source, not a statement.
- Why, with evidence? The cause, and the evidence for each link between the problem and the cause. A cause that stops at a person's name gets the next question: why did they do that?
- What was done? The correction that fixed the item and the corrective action that removed the cause, recorded as two different things, with an owner and a date.
- How do you know it worked? Evidence gathered after the action had time to fail: a measure that stayed where the fix put it, the process observed running the new way, no repeat in the register. A signature on the closure line is not evidence.
Run those four against your last five closed actions before the audit. The free 5 Whys worksheet covers the first two; the Root Cause & Corrective Action Toolkit carries the register and the 90-day check for the last two.
There is no clause 10.3 anymore
The 2026 edition merged continual improvement into 10.1, so a procedure, register or audit checklist that cites 10.3 is citing a clause that does not exist. The clause 10.3 page covers what replaced it and what to change in your documents.
What clause 10.2 requires
| Sub-clause | In plain words |
|---|---|
| 10.2.1 The steps | When a nonconformity occurs: react to it, which means controlling and correcting it and dealing with its consequences, as applicable. Then decide whether the cause needs to be eliminated so it does not happen again here or somewhere else, by reviewing the nonconformity, working out its causes, and checking whether similar ones exist or could occur. Implement whatever action is needed. Review whether the corrective action worked. Update the risks and opportunities you determined at planning if the case warrants it. Change the quality management system if it needs changing. Actions must be in proportion to what the nonconformity caused: a bent label does not get the same investigation as a shipped nonconforming part. A note observes that customer complaints are one place nonconformities come from. |
| 10.2.2 The records | Two must be available as evidence: what the nonconformity was and what was done about it, and what the corrective action achieved. |
Correction and corrective action are two different things, and the clause names both. Correction fixes the part in front of you. Corrective action removes the cause so the next part is right. A register that records corrections and calls them corrective actions is the most common way to fail this clause.
What changed in 2026
The steps did not change. Four things in the wording did: customer complaints moved from the opening sentence to a note, the review step no longer says "analysing," a tense changed in the similar-nonconformities step, and the records sentence uses the new available-as-evidence phrasing. Annex A, which is informative, adds that the organization decides how deep to investigate based on its context, weighing the risk of recurrence and the impact. The clause also lost its neighbor: 10.3 was merged into 10.1, and the 10.1 note no longer lists correction and corrective action as examples of improvement, which means a corrective action register alone no longer evidences continual improvement. The clause 10 page covers all of it.
What an auditor checks in the register
- A sample of closed actions, walked end to end. The nonconformity, the correction, the cause, the check for similar cases, the action, the effectiveness review with data, the closure. Each step is a row in the standard and a question in the audit.
- Whether the cause is a cause. "Operator error" and "training" are the two answers that trigger the follow-up: why did the operator do that, and would training have prevented it? A cause that names a person is a symptom.
- The similar-cases check. Did anyone ask whether the same failure exists on the other line, the other shift, the other product? The register should show the answer, even when it is no.
- Effectiveness, with a number. "Verified effective" with a signature is not a review. A measure that says the problem stayed gone is.
- The link to the risk register. Step e) asks whether risks and opportunities were updated. A sample of corrective actions that never touched the register, on a site with recurring failures, is a finding waiting to be written.
- Complaints inside the process. Customer complaints handled in a separate service loop that never reaches the register.
The findings that come up most
- Correction recorded as corrective action. The part was reworked; no cause was found; the action is closed.
- Cause stops at a person. Retraining as the standard fix, and the same nonconformity six months later.
- No effectiveness review, or one done on the day of closure before the fix has had time to fail.
- Everything gets the same form. Proportion cuts both ways: a hundred open actions on trivia is as much a finding as none on the serious case.
- Repeat nonconformities with no escalation. The register does not know it has seen this before.
If three of those five describe your register, the fix starts with the cause step, not the form. The $5+ 5 Whys & Cause Analysis Worksheet forces a problem statement, an evidence column beside every why, and the "therefore" read-back that catches a cause that stops at a person; the Root Cause & Corrective Action Toolkit adds the register that knows it has seen a nonconformity before and the 90-day check that closes an action on data instead of a signature.
How to run a corrective action that holds
- Write the problem statement first. What, where, when, who, how you know, how much. A vague statement produces a vague cause.
- Five whys with an evidence column. Every link in the chain names the evidence for it. Read the chain backward with "therefore" between the links; if it reads cleanly you have it. If the last answer is a person's name, keep going.
- Check the other cause categories so a single thread has not misled you: method, machine, material, people, measurement, environment. Score likelihood against evidence.
- Pick the control level before you pick the fix. Eliminate the step, design the failure out, detect it automatically, warn, procedure, train. Everything from warn down decays. If the fix depends on someone remembering under pressure, it is a delay, not a fix.
- Log it with an owner, a date and the control level, and set the verification date 90 days out.
- Verify with four questions at day 90: is the process still run the new way or has a workaround appeared, what does the leading indicator say, has anything upstream changed that the fix assumed was stable, and would a new hire trained today do it the new way. Then update the risk register and take the fix sideways to wherever else the same failure can happen.
The tool for this clause: the $5+ 5 Whys & Cause Analysis Worksheet, the problem statement, the five-whys chain with the evidence column and the therefore test, and the six-category cause scorer, with a worked case filled in. The Root Cause & Corrective Action Toolkit adds control selection, the CAPA register with its dashboard, and the 90-day effectiveness check.
Not sure where your system stands on the 2026 edition?
The free readout asks thirteen questions and gives you your readiness, your timeline to the deadline, and your first three actions. Nothing you enter leaves your browser unless you ask for the optional AI reading.
Run the free readoutSee every toolQuestions
What is the difference between correction and corrective action in ISO 9001?
Correction deals with the nonconformity in front of you: rework, scrap, sort, re-inspect. Corrective action removes the cause so it does not recur here or elsewhere. Clause 10.2 requires both where applicable, and asks you to decide whether cause elimination is needed rather than assume it.
What records does ISO 9001 clause 10.2 require?
Two: a record describing the nonconformity and everything done about it, and a record of what the corrective action achieved. In practice that is a register row with the problem, the correction, the cause, the action, and the effectiveness result.
Does every nonconformity need a corrective action?
No. The clause asks you to decide whether the cause needs eliminating, and sizes the action to what the nonconformity caused. A one-off with no risk of recurrence can be corrected and closed with that decision recorded. The 2026 Annex A says explicitly that the depth of investigation is the organization's decision, based on recurrence risk and impact.
How do I verify that a corrective action was effective?
With evidence gathered after the action has had time to fail, not on the day it was implemented. A leading indicator that stayed where the fix put it, the process observed running the new way, and confirmation that nothing upstream changed. A signature on the closure line is not verification.
What is a CAPA?
Corrective and preventive action, a term from medical device and pharmaceutical quality systems. ISO 9001 dropped the separate preventive action requirement in 2015 in favor of risk-based thinking in clause 6.1, so under ISO 9001 a CAPA register is a corrective action register whose step e) updates the risk register.
Is root cause analysis required by ISO 9001?
Determining the cause is required when a nonconformity occurs; the method is the organization's choice. 5 Whys, fishbone, or fault tree all qualify if the record shows the reasoning.