ISO 9001 clause 10.2.1: respond to nonconformity and prevent recurrence
ISO 9001:2026 clause 10.2.1 requires the organisation to react when a nonconformity occurs and evaluate the need for action on its causes so it does not recur or occur elsewhere. Necessary action must be implemented and any corrective action reviewed for effectiveness. The response should be appropriate to the effects of the nonconformity.
What clause 10.2.1 requires in practice
Clause 10.2.1 describes the response to a nonconformity as a sequence. First the organisation reacts: where applicable it takes action to control and correct the problem, and it deals with the consequences. Second it evaluates whether action is needed to remove the causes, so that the problem does not happen again or appear somewhere else. That evaluation has three components: reviewing the nonconformity, determining its causes and finding out whether similar nonconformities exist or could occur. Third it carries out any action found necessary. Fourth it reviews whether the corrective action was effective. Fifth, where necessary, it updates the risks and opportunities set during planning and changes the quality management system. The standard adds that corrective action should suit the effects of the problem, and notes that customer complaints can be a source of nonconformity. Correction and corrective action are therefore two different things: one fixes the instance, the other addresses the cause.
Respond to the event before the investigation is complete
React to the nonconformity and, as applicable, control and correct it and deal with its consequences. The relevant action depends on the situation. A failed delivered output may need control under clause 8.7, while a system nonconformity may require a different immediate response.
Do not leave a known problem uncontrolled while waiting for a perfect cause analysis. Equally, do not treat a successful immediate correction as proof that recurrence has been addressed. Restoring one output or completing one missing record may resolve the immediate condition without changing the process that produced it.
Evaluate the need for action on causes
Review the nonconformity, determine its causes and consider whether similar nonconformities exist or could occur. This evaluation helps establish what action is needed and how far it should extend. It should be grounded in evidence rather than stop automatically at labels such as “human error” or “lack of attention.”
The clause does not require every event to use the same lengthy investigation or a particular branded method. A straightforward issue and a repeated, consequential failure can justify different depth. Proportionality does not mean skipping the evaluation; it means matching the response to the issue and its effects.
When an action is selected, connect it to the supported cause. Repeating training may be appropriate for a demonstrated knowledge gap, but it will not necessarily fix an unclear instruction, an impractical workload or a missing process control. The proposed action should explain why recurrence is expected to become less likely.
Why clause 10.2.1 matters to the business
Fixing an instance without understanding why it happened leaves the business exposed to the same failure again, usually at a worse moment. Following the sequence in this clause protects customers in the short term and the organisation in the longer term. It also produces better-quality decisions about where to spend effort: a minor slip with no wider implication needs only correction, while a pattern may justify a change to a process, training or supplier arrangement. Checking effectiveness is what separates a real fix from a paper one, and it gives the organisation confidence to close an issue accurately.
How to implement clause 10.2.1
Build the sequence into the routine so that people follow it without extra paperwork. Where it helps, agree in advance who may decide that a cause investigation is not warranted, and require a short reason, so that the decision is deliberate and can later be explained.
- Give staff a simple way to raise a nonconformity and a clear first step, which is to control and correct it.
- Record the consequences for customers or other work, and decide who must be told.
- Ask whether a cause investigation is warranted, using the effect and likelihood of recurrence as the test.
- For those that qualify, examine the facts, test likely causes and check whether the same weakness exists elsewhere.
- Choose actions that address the cause, and agree an owner and a point at which results will be reviewed.
- At that point, check the evidence, including whether the problem has recurred, before closing the action.
- Update risk and opportunity information and system arrangements where the learning calls for it.
Evidence an auditor expects for clause 10.2.1
Auditors usually trace chosen cases through each stage. They look for records of the nonconformity and the immediate response, the consequences dealt with, the review and cause determination where it was warranted, the action taken and the later review of its effectiveness. Where relevant, they check that risks or the system were updated. Interviews with those who raised or handled the case confirm whether the account matches events, and observation of the work shows whether the change is in use. A particular root-cause tool or form is not required, and proportionate evidence is acceptable for minor cases.
Common nonconformities with clause 10.2.1
Typical findings relate to missing stages in the sequence. Gaps are most often seen where the cause stage is skipped or shortened.
- Correction is recorded but no one evaluated whether the cause needed action.
- The cause is stated as human error without examining why the error was possible.
- Corrective actions are marked complete with no review of effectiveness.
- The search for similar nonconformities elsewhere is never made.
- Risks and opportunities or system arrangements are not updated even where the investigation showed they should be.
Illustrative software example: repeated wrong configuration
A software provider repeatedly deploys a customer configuration using an outdated parameter set. The immediate response restores the correct configuration and assesses the affected service. The investigation finds that two similarly named files remain available in the deployment location and the release check does not distinguish them reliably.
The team controls the source of current configuration information and revises the relevant verification step. It checks later deployments for correct selection and completion of the intended control. The effectiveness review uses actual subsequent work, not just evidence that the instruction was edited. It also considers whether other customer configurations use the same vulnerable arrangement.
Illustrative construction example: recurring handover omissions
A contractor finds missing inspection evidence in several handover packs. Completing the missing pack is the immediate correction where the required evidence can legitimately be obtained. The cause evaluation follows how records pass from subcontract teams to the project handover owner and identifies an unclear responsibility at an interface.
The contractor clarifies the transfer arrangement and checks subsequent packs from the affected interface. It also reviews comparable projects for the same weakness. The action is assessed against whether the required evidence arrives reliably, not whether everyone attended a briefing. Records must reflect work actually performed; missing evidence should not be invented to make a pack appear complete.
Review effectiveness and update the system when needed
Effectiveness review asks whether the corrective action addressed the cause and intended outcome. Select relevant evidence and a suitable point for review. A system may need enough subsequent activity to make a conclusion meaningful; absence of a recurrence during a period with no relevant work is weak evidence.
Update the risks and opportunities determined during planning if necessary, and make QMS changes if necessary. These are conditional requirements, not a demand to rewrite the entire risk register or QMS after every event. The evaluation should establish whether the incident reveals information that needs to change those arrangements.
Customer complaints can be a source of nonconformities, but a complaint should be assessed against the facts and requirements. Some complaints reveal a failure; others express a preference or expectation not previously accepted. Respond appropriately without automatically treating every comment as the same category of issue.
Common failures include choosing actions before understanding causes, limiting the response to the location where the issue was first found, and closing corrective action on implementation alone. Another is using blame as a substitute for analysis. A useful process makes it safe to establish facts while maintaining responsibility for action.
Frequently asked questions
Does every nonconformity need a full root-cause project?
The need for action on causes must be evaluated, but the method and depth should be proportionate. The standard does not prescribe one full-scale investigation format for every event. A repeated or consequential issue generally warrants more attention than a limited, well-understood case.
What is the difference between correction and corrective action?
Correction addresses the detected nonconformity. Corrective action addresses its cause to prevent recurrence or occurrence elsewhere. Replacing an incorrect output may be correction; changing the process that repeatedly creates it may be corrective action.
When can corrective action be considered effective?
When relevant evidence supports that it achieved the intended result. Implementation alone is not enough. Consider the nature of the cause, subsequent activity and whether similar issues remain before concluding that the action worked.
Improve the quality of cause and effectiveness decisions
Sterling can support a proportionate corrective-action process, with scoped use of Effivity ISO & GRC automation software where agreed. Certification decisions remain independent.
Explore the live Root Cause Analysis and CAPA course for focused learning on causes and action. Register interest in forthcoming QMS training to connect that learning with the wider system.