In short
Correction eliminates the detected nonconformity; corrective action eliminates its cause so that it does not recur or occur elsewhere.
Clause 10.2 asks you to evaluate the need to analyse causes: actions must be appropriate to the effects of the nonconformity.
The 5 Whys go deep along one chain; the Ishikawa diagram widens the view across six families of causes. Together they are more robust.
"Human error" is rarely a root cause: ask why the process allowed the error and did not catch it.
Define the effectiveness criterion before implementing the action and close it only with evidence that the problem does not come back.
Fixing the error is not enough: you need to stop it happening again. This is where many ISO 9001 certified companies stumble. The defective part is replaced, the customer gets an apology, the nonconformity form is filled in. Then, a few months later, the same problem comes back, perhaps in another department. Corrective actions exist precisely to break this cycle: not to repair the damage, but to eliminate the cause that produced it.
In this guide you will see what clause 10.2 of ISO 9001 really requires, based on the text common to all management system standards, and how to tell correction from corrective action. This also holds for the new edition, ISO 9001:2026, published in September 2026, which is still built on the harmonized structure. Then we get practical: we apply the 5 Whys and the Ishikawa diagram to a concrete case, a labelling error at a manufacturing company, all the way to an action plan that stands up at audit and a check of its effectiveness. If you first need an overview of the quality system, start with the guide on how to build an ISO 9001 quality management system.
What is a corrective action under ISO 9001?
A corrective action is an action to eliminate the cause of a nonconformity and to prevent recurrence. The definition comes from the harmonized structure of ISO management system standards, the same foundation used by ISO 9001, ISO 14001, ISO 27001 and ISO 45001. The basics of these standards and their common structure are in the guide on what ISO certifications are.
The key word is cause. A corrective action does not act on the wrong part or the late delivery: it acts on whatever made that error possible. The guidance of the ISO 9001 Auditing Practices Group, the joint ISO and IAF group that publishes guidance for auditors, says so explicitly: without determining the cause there is no corrective action.
Correction, containment and corrective action: three different things
Correction is the action to eliminate the detected nonconformity: you replace the defective part, relabel the batch, withdraw the obsolete version of a procedure. It solves the individual case, but does not stop it from happening again.
Containment, which the standard covers under "controlling" the nonconformity, keeps the problem from spreading while you look for the cause: quarantining stock, checking every outgoing batch, informing the customer.
Corrective action, finally, addresses the cause: it changes a method, a check, a tool, a responsibility. The Auditing Practices Group guidance asks auditors to verify that the company has dealt with all three parts: correction, cause analysis and corrective action. The order can vary: in some cases, software for example, correcting before you know the cause can make things worse.
Why "preventive action" is no longer used
The harmonized structure does not use the term "preventive action". If you remember the old separate forms for corrective and preventive actions, that logic has now been absorbed into the management of risks and opportunities.
The harmonized structure guide translated by UNI, the Italian standards body, explains it clearly: actions to address risks are preventive in nature with respect to potential negative effects. In practice, corrective action responds to a problem that has already happened; risk management prevents possible ones. The two are connected: a well-run cause analysis often reveals new risks to add to the register.
What clause 10.2 of ISO 9001 requires, point by point
Clause 10.2 "Nonconformity and corrective action" asks you to react, analyse, act, verify and, where needed, change the system. The core text is identical in all standards built on the harmonized structure (Annex SL); each standard can add requirements specific to its own discipline.
When a nonconformity occurs, the organization must:
react to it, taking action to control and correct the nonconformity and dealing with the consequences, as applicable;
evaluate the need for action to eliminate its causes, so that it does not recur or occur elsewhere, by reviewing the nonconformity, determining its causes and determining whether similar nonconformities exist or could occur;
implement any action needed;
review the effectiveness of any corrective action taken;
make changes to the management system, if necessary.
Two sentences complete the requirement. First: corrective actions must be appropriate to the effects of the nonconformities encountered. A typo in an internal form does not deserve the same analysis as a complaint that stopped a customer's line. Second: documented information must be available on the nature of the nonconformities, the actions taken and the results of corrective actions.
"Does not recur or occur elsewhere"
This passage makes the difference at audit. The standard does not only ask you to stop the same error recurring in the same place, but to ask yourself where else it could happen. If a wrong label left the packing department because the ERP automatically suggests the last code used, the same mechanism could affect delivery notes or inspection certificates.
What the standard does not require
Clause 10.2 does not impose any analysis tool: not the 5 Whys, not Ishikawa, not specific forms. Nor does it set internal deadlines for closing an action. It asks you to show that you have a consistent method, proportionate and working. The tools you will see below are the most widespread, but the choice remains yours.
When is a cause analysis really needed?
Not every nonconformity requires an in-depth analysis: the standard asks you to evaluate the need, not to always carry it out. It is an often misunderstood point that leads to two opposite mistakes: full analyses for every trifle, or no analysis at all for recurring problems.
The UNI harmonized structure guide recognises that it is not always possible, technically feasible or economically viable to identify or completely eliminate the cause. The Auditing Practices Group guidance adds that correction and corrective action are not always both needed: if the error was truly accidental, the system is effectively implemented and the probability of recurrence is very low, one of the two may be enough. But this must be justified and recorded, not taken for granted.
Systemic or accidental?
The question that matters is whether the cause is systemic or a one-off. A systemic problem treated as an isolated case leads to ineffective action and a real risk of recurrence. Some signals help you tell when a serious analysis is needed:
the nonconformity has happened before, even in a different form;
it reached the customer or has consequences for safety, legal requirements or contracts;
it was raised at a certification audit, especially if graded as major;
it involves several departments or a process with no clear owner;
the first explanation that comes to mind is "operator error".
If you fall into one of these cases, a structured analysis is worthwhile. For an isolated event, with minimal impact and an obvious cause, a well-recorded and justified correction is enough. To understand how certification bodies grade findings, read the guide on major and minor nonconformities.
How to apply the 5 Whys without stopping at the first answer
The 5 Whys is an iterative technique: you ask "why?" of every answer until you reach a cause the system can act on. The number five is indicative: sometimes three questions are enough, sometimes you need six. The Auditing Practices Group guidance mentions it as a useful technique and warns against mistaking the first factor found for the root cause.
The case: wrong labels on a shipped batch
Take a typical company: 40 employees, plastic component moulding, ISO 9001 certified. A customer reports that a batch arrived labelled with a different code from the one inside the boxes. The parts are right, the label is not: the customer blocks the batch at goods-in. It is the second similar incident in recent months.
Correction and containment are immediate: batch relabelled at the customer's site, stock checked and, for a few weeks, a double check on every shipment. The real question remains: why it happened, and why it happened again.
The 5 Whys chain
The quality manager, the warehouse supervisor and the operator involved reconstruct the chain:
Why did the batch have the wrong label? Because the operator printed the label for the code produced previously.
Why did they print that code? Because the ERP automatically suggests the last code used and the operator confirmed it without comparing it with the production order.
Why did they not compare it? Because the packing instruction does not require any cross-check between label and order: the check is left to the eye.
Why does the instruction not require it? Because it was written when the company had a few very different codes; today it has dozens of almost identical variants, distinguished only by colour.
Why was it not updated? Because when the new variants were introduced nobody assessed the impact on downstream processes: introducing new codes does not trigger a review of warehouse and labelling.
The root cause is not "operator distraction". It is incomplete change management: the company changes the product but does not review the processes that depend on it. This cause can be acted on, and the action also protects against problems other than labels.
Typical mistakes with the 5 Whys
The first mistake is stopping at the person: if a process depends on someone's perfect attention at the end of a shift, the problem is the process. The second is following a single chain when there are several causes: this is where the 5 Whys show their limits, and it is time to add an Ishikawa diagram. The third is answering with unverified assumptions: every "why" should rest on a checked fact, such as a record, an ERP screenshot or an interview.
How to use the Ishikawa diagram so you do not miss causes
The Ishikawa diagram, also called fishbone or cause-and-effect diagram, organises the possible causes of a problem into families. While the 5 Whys go deep along one line, Ishikawa widens the view and reduces the risk of overlooking a factor. The ISO 9001 auditor guidance mentions it, together with the 5 Whys, among the tools for determining causes.
The six families of causes
The classic families are six, often called the "6Ms": people, machines, materials, methods, measurement and environment. The same categories appear in the Auditing Practices Group guidance as the starting point for the first "why". For our case the diagram looks like this:
Family | Possible causes identified |
|---|---|
People | Operator in training for only a few weeks; evening shift with less supervision |
Machines and tools | The ERP suggests the last code used; no barcode reader at packing |
Materials | Pre-printed labels very similar across variants |
Methods | Obsolete packing instruction; no cross-check against the order |
Measurement | Labelling errors not tracked as an indicator; complaints not analysed by type |
Environment | Packing area crowded during month-end peaks; frequent interruptions |
From hypotheses to confirmed cause
A diagram full of hypotheses is not yet an analysis. The Auditing Practices Group guidance suggests a simple step: list the possible factors and categorise them as not able to confirm, possible or confirmed, based on evidence. In the case, the evening shift turns out to be not confirmable, because the first incident happened in the morning; the ERP and the obsolete instruction are confirmed; the crowded area is a contributing factor.
At this point the two tools meet: the confirmed branches of Ishikawa become the starting point for the 5 Whys, which lead to the root cause. In practice, Ishikawa helps when the possible causes are many and involve several departments; the 5 Whys are enough when the problem is contained and the chain is linear. For the most significant nonconformities, using them together is the most robust choice.
From cause to action: how to write a plan that stands up at audit
A good action plan links every action to a confirmed cause, with an owner, a date and an effectiveness criterion. If an action does not respond to any identified cause, it is probably just activity.
For our case the plan looks like this:
Element | Content |
|---|---|
Nonconformity | Batch shipped with a label for a different code, customer complaint; second incident |
Correction and containment | Relabelling at the customer's site; stock check; double check on outgoing goods for a defined period |
Root cause | New variants introduced without reviewing downstream processes; instruction with no cross-check |
Corrective actions | Barcode scanning at packing with automatic comparison against the order; updated instruction and training; mandatory impact checklist for every new code |
Extension | Check of the same risk on delivery notes and inspection certificates |
Owners and deadlines | A name and a date for every action |
Effectiveness check | Criterion defined in advance, check date, recorded outcome |
Note the difference between actions. Training on its own would have been a weak action, because it still relies on people's attention. The automatic check removes the opportunity for error, and the checklist on new codes acts on the root cause, also protecting processes other than labelling.
What the auditor looks at in the response
The auditor guidance indicates what to verify when a company responds to a nonconformity: actions described clearly and precisely, references to specific documents, past tense for what has been done, completion dates already passed rather than future ones, evidence that the action was implemented as described. The auditor also checks that the action does not create new problems for quality or the system.
In this work, with Complaion you have a dedicated Lead Auditor who follows your company: they help you set up the cause analysis, separate what really matters from bureaucracy and write verifiable actions. The platform collects evidence in one place, manages up-to-date documents and keeps the schedule of effectiveness checks, so actions do not get lost among emails and spreadsheets.
How to verify the effectiveness of a corrective action
A corrective action is effective if the problem does not recur because the cause has been eliminated. Completing it is not enough: clause 10.2 requires you to review its effectiveness, and an auditor closes a nonconformity only with evidence that the action is in place and working.
The practical rule is to define the criterion before implementing the action, not afterwards. In our case: no wrong labels in shipments over the following months, barcode check records available and complete, checklist completed for every new code introduced in the period. The criterion must be observable and the check should take place after an interval long enough for the problem to reappear if the cause persisted.
Where effectiveness is checked
There are three natural opportunities. The first is a dedicated check, on the date set in the plan, by someone who did not implement the action. The second is the internal audit, which can sample closed actions: the guide to the ISO internal audit explains how to plan it. The third is the management review, which under the harmonized structure must consider trends in nonconformities and corrective actions.
If the check fails, the action is not "closed anyway": the analysis is reopened, because the cause identified was probably not the real one. It is a normal outcome, as long as it is recorded. When instead the analysis leads to changing a process or a responsibility, like the checklist on new codes, also update the related documents and risks: this is the change to the management system required by the last point of clause 10.2.
The most common mistakes in managing corrective actions
The most frequent mistakes come from treating corrective action as a task to close, not as a tool to improve.
"Human error" as the root cause
It is the most written and least useful cause. People make mistakes, but a robust system makes errors hard to commit and easy to catch. If your analysis stops at the operator, ask yourself why the process allowed them to get it wrong. By the same token, "operator training" as the only action is a warning sign: fine as a complement, rarely as the solution.
Actions without evidence or with future dates
A register with actions "in progress" for months, with no owner or attached evidence, tells the auditor the process is not under control. Every closed action should have proof of what was done: the updated document, the training record, the photo of the installation, the ERP extract.
Disproportionate or missing analyses
Running a full Ishikawa for a typo in a form is waste; running none for a recurring complaint is a risk. The standard asks for actions appropriate to the effects: define in a simple procedure when correction is enough and when a structured analysis is needed, and apply the criterion consistently.
Looking only where it happened
Forgetting "occur elsewhere" is a frequent mistake. After every analysis, take a few minutes to ask which other processes share the same weakness. This is where a corrective action becomes real improvement of the system and not just the repair of one case.
How Complaion helps you manage corrective actions
Managing corrective actions well means finding the real cause, acting on it and showing that it worked. The method is not complicated, but it needs a continuity that is easily lost among urgent jobs, emails and scattered files.
With Complaion you have a dedicated Lead Auditor who follows your company: they help you analyse nonconformities, choose the right tool for each case and write actions that stand up at audit. They also conduct the internal audit, where they sample the closed actions, so the effectiveness check does not stay on paper. The platform collects evidence, manages documents, keeps the schedule of actions and effectiveness checks and prepares the internal and certification audits. The path is proposed according to your company's needs, whether you are preparing your first ISO 9001 certification or maintaining a system that is already running.
More than 1,000 clients have already chosen Complaion for their management systems. If you want to work out how to set up your corrective action process, talk to our team or request a quote based on your situation.
Frequently asked questions about ISO 9001 corrective actions
What is the difference between correction and corrective action?
Correction eliminates the detected nonconformity: you replace the part, relabel the batch, update the wrong document. Corrective action eliminates the cause of the nonconformity, to prevent it from recurring. The first solves the individual case, the second protects the process. Usually you need both, but ISO 9001 asks you to evaluate case by case whether corrective action is necessary.
Is a corrective action needed for every nonconformity?
No. Clause 10.2 asks you to evaluate the need for action to eliminate the causes, and actions must be appropriate to the effects of the nonconformity. For an isolated event, with minimal impact and an obvious cause, correction may be enough. However, the decision must be justified and recorded, because the auditor may ask why you did not look further.
How many whys should you ask in the 5 Whys?
The number five is indicative, not a rule. You stop when you reach a cause the management system can act on and which, if eliminated, would prevent the problem from recurring. If the last answer concerns a person ("they were distracted"), you have usually not yet reached the root cause. Every answer should rest on a verified fact.
Is the Ishikawa diagram mandatory for ISO 9001?
No. The standard does not impose any cause analysis tool. The ISO 9001 Auditing Practices Group guidance mentions brainstorming, fishbone diagrams and the 5 Whys as examples, and asks auditors to be familiar with their appropriate use. You can choose the method you prefer, as long as it is consistent and proportionate and you keep a record of it.
What documents prove that corrective actions are managed?
The harmonized structure requires documented information on the nature of nonconformities, the actions taken and the results of corrective actions. In practice: the description of the nonconformity, the correction, the cause analysis, the plan with owners and dates, the evidence of implementation and the outcome of the effectiveness check. The format is up to you: form, register or digital platform.
How long do I have to close a corrective action?
ISO 9001 does not set deadlines for internal nonconformities: you set them in the plan, in proportion to severity. For nonconformities raised at a certification audit, however, response times and methods are communicated by the certification body. In both cases, the effectiveness check needs an interval long enough to see whether the problem comes back.
Can "human error" be a root cause?
Rarely. People make mistakes, but the useful question is why the process allowed the error and did not catch it. Automatic checks, clear instructions, sustainable workloads and suitable tools reduce the opportunity for error. If the analysis stops at the person, the action will almost always be "training", which on its own is rarely enough.
Who should carry out the cause analysis?
There is no mandatory role, but the analysis works best in a small group: whoever knows the process, whoever experienced the event and whoever has a role in the quality system. Involving the person who made the error, in a no-blame climate, brings out information that no document contains. Top management must ensure time and resources to implement the actions decided.
