ISO 9001 clause 10.2.2: preserve corrective-action evidence

What clause 10.2.2 requires in practice

Clause 10.2.2 is the evidence requirement that supports clause 10.2.1. The organisation must hold documented information showing two things. The first is what kind of nonconformities occurred and any later actions taken: what went wrong, and what was done about it at the time and afterwards. The second is the results of any corrective action, which means what the action achieved and not only that it was carried out. Taken together, the records should let a reader follow the case from the original issue through the response to the outcome. The clause does not prescribe a form, a ticketing tool or a single location, so the evidence may sit in several systems if it can be connected. It also does not demand that every minor correction be written up at length, although the record should be sufficient for the organisation's own learning and for any external review.

Keep the original issue clear

Describe the nonconformity in factual terms, including the relevant requirement and departure where needed to understand it. Connect the issue with the affected process, output or event. A category such as “documentation failure” may assist analysis but is rarely sufficient as the complete description.

Distinguish the observed facts from the cause conclusion. The first record may identify only what failed; later investigation can add supported explanations. Preserve that development rather than overwriting the original event so the record appears to have contained the final answer from the beginning.

Record subsequent actions accurately. These may include immediate control, correction, consequence management, evaluation and necessary corrective action. The information should make clear which actions occurred and which remain planned. A promise to revise a process is not evidence that the revision was implemented.

Why clause 10.2.2 matters to the business

A record of what went wrong and what it achieved is the memory of the quality system. Without it, the same failure can be solved three times by three different people, none of whom knows what the others learned. Accurate records help managers see recurring patterns, let customers see that their concerns were taken seriously and help the organisation prove, rather than assert, that its fixes work. They also protect the business in disputes, because an accurate account of what was found and done is more convincing than recollection. Poor records, in contrast, weaken the credibility of an otherwise effective response.

How to implement clause 10.2.2

Aim for a record that tells the story in a few clear lines and can be traced across systems. Write the record as events happen where you can, because accounts reconstructed weeks later tend to be tidier than the truth and lose detail that would help the next investigation.

1. Decide the minimum facts to be captured for each nonconformity, such as the output or service concerned, what was wrong and the requirement not met.
2. Capture the immediate action and any customer communication at the time it happens.
3. Record the cause conclusions and corrective actions separately from the original description, so the first account is not rewritten.
4. Record the review result of the corrective action, including the evidence examined and the conclusion reached.
5. Use a common reference so that entries held in different tools can be linked.
6. Where effectiveness cannot yet be checked, note the planned check and keep the case open or visibly pending.
7. Review a sample of closed cases regularly to confirm that the story is complete and understandable.

Evidence an auditor expects for clause 10.2.2

Common nonconformities with clause 10.2.2

Findings at this clause typically show records that stop before the result. The pattern is usually visible when closed cases are read from the start.

• Corrective-action records show actions completed but give no result.
• The original description is overwritten, so the first account of the problem is lost.
• Records for the same case are held in several systems with no way of linking them.
• Nonconformities are described only as a category, such as quality issue, without stating what was wrong.
• Effectiveness is recorded as confirmed without any evidence behind the statement.

Illustrative IT example: an incomplete service handover

Illustrative manufacturing example: repeated incorrect setup

A manufacturer investigates repeated setup errors on a product family. The record connects the affected jobs, the failed requirement and the immediate corrections. The cause analysis identifies ambiguity between two setup references, and the action changes how the current instruction is selected and verified.

After relevant production has occurred, the effectiveness review examines setup selection and resulting conformity. The record preserves the sample and conclusion, including any remaining uncertainty. If the product has not run again, the team does not fabricate a successful verification; it records that outcome evidence is still pending and plans an appropriate review point.

Show what the corrective action achieved

The results of corrective action should address its intended purpose. Depending on the issue, relevant evidence may include subsequent output results, observed use of a changed control or confirmation that comparable processes were reviewed. The exact form depends on the action and the cause it was meant to address.

Completion and effectiveness are different. A training session can be completed while the process error continues. A new control can be installed but routinely bypassed. Preserve enough evidence to show whether the action worked, partly worked or needs revision. An accurate unresolved status is more useful than an unsupported success statement.

The standard does not prescribe one corrective-action form, a mandatory software platform or a universal retention period in this clause. Select a proportionate record method and apply the organisation's relevant documented-information controls and applicable obligations. Where several systems hold the evidence, keep the links dependable and the overall case understandable.

Make the record useful for future review

Organise information so recurring issues and overdue actions can be identified without losing the detail of individual cases. Consistent categories can help, but they should not force different problems into the same vague label. A reviewer should be able to follow the original nonconformity through the response and result.

Use relevant evidence in analysis, internal audit and management review. Repeated action extensions, uncertain effectiveness or the same cause appearing elsewhere may indicate a wider weakness. The record should enable that learning rather than function only as a closure certificate for a single event.

Common failures include describing the action but not the original nonconformity, claiming that a cause was removed without evidence, and retaining only the final approval. Another is losing the connection between a parent issue and actions carried out in other teams. Preserve the relationship so the organisation can assess the whole response.