ISO 9001 Clause 10.2: Correct Problems and Test the Result

What clause 10.2 requires in practice

Clause 10.2 sets out what happens when a nonconformity occurs, including those arising from customer complaints. In clause 10.2.1 the organisation reacts: where applicable, it takes action to control and correct the problem and deals with the consequences. It then evaluates whether action is needed on the causes, so that the problem does not recur or arise elsewhere, by reviewing the nonconformity, determining its causes and checking whether similar ones exist or could occur. Any needed action is carried out, its effectiveness reviewed, and risks and opportunities updated and system changes made if necessary. The corrective action must be proportionate to the effects of the problem. Clause 10.2.2 asks for documented evidence of the nonconformities and actions taken, and of the results of corrective action. The standard does not prescribe a root-cause technique, a form or an investigation for every minor slip.

React to the immediate problem and consequences

First establish what has failed and the relevant requirement. Take appropriate steps to control or correct the situation and deal with its consequences. Those decisions depend on the product, service, customer and applicable obligations. They may involve controlled work, customer communication or other authorised action; this guide does not prescribe a universal technical response.

Correction addresses the detected problem. Corrective action addresses a cause to prevent recurrence. The same event can require both, but recording a correction does not automatically establish that causes have been understood. Conversely, not every minor occurrence requires an elaborate investigation. Evaluate the need proportionately and preserve a clear basis for the response.

Why clause 10.2 matters to the business

Every nonconformity is a cheap lesson if it is understood and an expensive repeat if it is not. This clause separates fixing today's problem from stopping tomorrow's, and asks for effort in proportion to the risk. Customers value suppliers who correct problems quickly and who rarely repeat them, so disciplined handling of nonconformity supports retention and reputation. It also reduces hidden cost: repeated rework, returns and escalations rarely appear in one place, yet add up. For assessors, a sound record of cause, action and checked result is among the clearest proofs that the system learns.

How to implement clause 10.2

Create a response that is quick for the small and thorough for the serious. Use plain language in the record, so that someone reading it a year later, perhaps from another department, can understand what happened without having to ask the original team or search other systems.

1. Define what counts as a nonconformity in your business, and how people raise one, including complaints.
2. Respond immediately by controlling the problem, correcting it and protecting customers affected.
3. Decide the depth of investigation from the effect and the chance of recurrence, using simple methods for minor matters.
4. Determine the likely causes, and check whether the same problem could be present elsewhere.
5. Select and carry out the action needed, with an owner.
6. Review after a suitable interval whether the problem has stopped, and record what you found.
7. Where the evidence requires, update risks, opportunities and the system, and keep the record connected from event to result.

Evidence an auditor expects for clause 10.2

Common nonconformities with clause 10.2

Findings at this clause concentrate on weak causes, weak checking and weak records. These weaknesses are usually visible in the case records.

• Problems are corrected but there is no evidence that causes were considered.
• Corrective actions are closed when completed, with no review of whether they worked.
• The investigation is the same for every problem regardless of effect, either too light for serious ones or heavy for trivial ones.
• Similar nonconformities elsewhere in the business are not looked for.
• Complaints are logged but never evaluated as possible nonconformities.

Illustrative BPO example: the wrong customer instruction

Evaluate causes and exposure elsewhere

Review and analyse the nonconformity, determine causes and consider whether similar problems exist or could occur elsewhere. Do not stop with a label such as “human error”. Examine what made the error possible and why the relevant control did not prevent or detect it. Evidence should support the causal explanation rather than merely confirm the preferred opinion.

Wider exposure may involve other products, services, shifts or sites that use the same process. A local incident can reveal a shared weakness. Equally, avoid assuming every branch has the identical problem without checking conditions. An effective review identifies where the finding applies and what information supports that judgement.

Choose action and define effectiveness before closure

Actions must suit the effects of the nonconformity. Consider whether the response changes the relevant process, information, resource or decision. Assign responsibility and provide enough support to implement it. Where necessary, update risks and opportunities or make changes to the QMS so the learning is incorporated into normal operation.

Define what would demonstrate that the action works. Evidence can include a suitable sample of later work, observation of a changed interface or performance information over a meaningful period. An implementation photograph or signed attendance sheet may show completion of one step, but not the effectiveness of the overall response.

Illustrative manufacturing example: repeated rework after setup

A hypothetical manufacturer repeatedly reworks the first items from a production changeover. Operators are reminded to be careful, but the pattern continues. A supported investigation examines the setup information, equipment condition, verification arrangements and how production is authorised after the change.

Suppose evidence identifies an ambiguous setup parameter and unclear approval responsibility. The responsible technical team revises the control and verifies it through appropriate work. Quality staff then review later changeovers against the intended result, including whether the initial problem reappears. The example illustrates a corrective-action decision, not a machine setup procedure or a guarantee that one intervention eliminates every defect.

10.2.2: preserve the problem, response and result

Retain the required information about the nature of the nonconformity, subsequent actions and corrective-action results. A record should allow a reviewer to understand what happened and why the closure decision was justified. The standard does not require a particular form or branded investigation technique.

An auditor may compare the stated cause with the chosen action and examine later evidence. Unsupported conclusions, identical “retrain staff” actions and closure before any meaningful effectiveness review are warning signs. So is changing the metric or stopping reports in a way that makes recurrence harder to see. Reliable reporting is part of learning from the problem.

Explore each numbered part