Management system guidance
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018.
Our range of templates cover the requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018, and offer an easy way to implement your next management system.
10.2 Non-Conformity and Corrective Action
There is a clear link between ISO 9001:2015 Clause 8.7 Non-conforming Outputs and Clause 10.2 Non-conformity and Corrective Action, this guidance document provides a 6-step methodology for meeting the requirements in each of these clauses. These clauses state the requirements for the occurrence of a non-conformity and include actions to prevent a similar non-conformity or problems occurring.
Your organization is required to take whatever action is necessary to control and correct the non-conformity, and to deal with any resulting impact by determining what caused the non-conformity and considering whether the potential for a similar problem remains.
This is done by considering whether any further action is required to prevent a similar non-conformity arising at the same place or occurring somewhere else, at some point in the future and by determining if similar non-conformities have occurred elsewhere; and consequently, whether it needs to take similar corrective action.
Taking appropriate action to address the effects of the problem may require a simple correction by the process owner or operator where it was discovered, or, if a major failure or defect exists, more significant levels of resource would be needed for problem solving and corrective action.
There may be instances where it is impossible to completely eliminate the cause of the non-conformity, so in these instances, the best you can do is to reduce the likelihood or the consequences of a similar problem happening again in order to reduce the risk to an acceptable level.
Any non-conformities and subsequent actions to prevent their reoccurrence and the effectiveness of the corrective action(s), should be duly documented and retained. Therefore, consideration should be given to the development and use of a Corrective Action Log to capture this information.
Our new range of audit checklists include the tools needed for corrective action management in accordance with ISO 9001.
Identify the Problem
Once a problem has been identified through inspection, customer complaints, or audit results, it should be captured using non-conformity reports (NCRs) or corrective action reports (CARs) in order to identify who is affected by the problem and what the impact is. Considering the following:
- What are the operations, products, materials, defects, malfunctions that may characterise the problem? What is it about?
- Who is concerned with the problem? Who is reporting the problem? Who is rectifying the problem? Who is the problem affecting?
- Where are all the places where the event takes place; shop floor, services, machine, process step?
- Where is it seen? Where does it originate?
- When does the event appear (time, date, when does it start, how long does it last, how often)
- When is the problem reported defective? When is the problem repaired?
- Has it occurred before? If yes, what is the history?
- How do we know there’s a problem (how is it detected)?
- How does the event appear, how does it stop?
- How frequently is the problem experienced?
- How is the effect of the problem being measured (costs, delays, scrap rate, customer complaints, return rate, concessions, reliability rate, etc)?
- How is the problem currently addressed? How is it corrected?
This step helps to fully describe a situation, precisely analyse all its elements and gain a common understanding of them, allowing the definition of an action plan. Ensure that all team members agree about the definition of the issue and resulting impact.
Define the Problem
The problem description should describe the problems in terms of what, where, when, and how big. On a flip chart, presentation board, or even paper; write out a description of what you know about the problem. Try to document the problem and describe it as completely as possible.
The description should contain facts; such as observations and documentary evidence and not assumptions. All information must be gathered before identifying the root-cause can begin.
Make sure both of the above factors are true before you move to the next step. Consider any new information that the team may have gathered since completing the initial problem description.
Describe the problem by identifying what is wrong and detail the problem in quantifiable terms. Define, verify and implement the interim containment action to isolate the effects of the problem from any internal/external customer until Permanent Corrective Actions (PCA) are implemented.
Establish a Response Team
Identify representatives from functions that may have an influence on the corrective action process, including the identification of the root causes. Remember to assign responsibilities and objectives to the team members.
Remember, those performing the job, such as operators, inspectors, drivers, etc., are the best people to help identify the real causes, don’t leave them out of the team!
The size and composition of the team should depend on the complexity and the impact of the problem. The composition of the team is not fixed forever and may evolve depending on the analysis results and the required actions.
New team members should join the team if analysis shows they are identified as being in the scope, some others will leave if their area is definitely identified as out of the scope.
However, consideration should be made that expending the size of the core team over 6 to 8 members generally results in less efficiency. When more members or special skills are required, sub teams should be considered. Don’t forget, root-cause analysis must not be used for assigning blame or transferring responsibility. In summary, you should establish an investigation team with:
- Process and/or product knowledge;
- Allocated time and resources;
- Authority to solve the problem and implement corrective actions;
- Skill in the required technical disciplines;
- A designated Team Leader.
Brainstorming sessions should be used to identify potential causes to investigate each potential cause. Coordinate parallel activities with different team members to help expedite the process of verification.
Understand the Problem
Once you have reviewed the problem description, you can undertake a comparative analysis. A comparative analysis will help you identify relevant changes in a change-induced situation. Then you can reduce the number of possibilities that you must consider to determine root-cause. To complete a comparative analysis:
- Ask yourself; what is unique, peculiar, different, or unusual about the symptoms?
- Consider features such as people, processes, materials, machines and the environment;
- List all facts without prejudice as to the possible cause;
- Consider each difference you listed, and look for changes, ask yourself what has changed to give rise to this difference?
- Keep in mind that each difference may not have a corresponding change;
- List the changes next to the difference;
- Look at the dates each change occurred;
- Eliminate some changes if they occurred after the problem started;
- Consider categories of people, machines, processes or measurements.
If the problem is change-induced, the root-cause must be the result of a change relative to one or more of the identified changes. It is important to remember that you have not yet moved from the ‘observations’ phase of the process.
Any information you develop during the comparative analysis must be fact based, not opinion based and must be true only for the symptom’s information. Do not rule out any facts that might be valid answers. If it is a fact and it answers the question, write it down.
Your organization should first contain the problem by taking immediate corrective action (ICA) and then evaluating the need for initiating the formal problem-solving process.
Where necessary, provide an emergency response action to protect the customer from the problem, protect the customer operations and the organisation (to stop the problem getting worse) and verify that problem does not degrade until the root-causes are known.
An interim containment action is kept in place until a verified permanent corrective action can be implemented. In some cases, the interim containment action may be the same as or similar to the emergency response action. An interim containment action provides more opportunity for investigation.
Conduct trial runs whenever possible. However, in some situations, your verification may simply be a matter of common sense. For example, if an interim containment action involves stopping the shipment of all products, you can be sure that customers will stop experiencing the problem.
An interim containment action can be any action that protects the customer from the problem. However, before you implement an interim containment action, you need to verify that the interim containment action will work. To verify the interim containment action:
- Prove before implementation it protects the customer from the problem;
- Provide a before-and-after comparison;
- Prove that the interim containment action will not introduce any new problems.
Methods of verification may include:
- A test to determine the desired performance level;
- A demonstration that changes eliminated the issue without creating a new problem;
- A comparison between the interim containment action and similar proven actions;
- A review to evaluate whether the interim containment action was effective;
- Assurance that the interim containment action did not introduce a new problem.
Any interim containment action you implement must protect the customer from the problem without the introduction any new problems. Also, a single interim containment action may not be enough. You may need to implement more than one interim containment action to fully protect the customer.
Identify the Root-Cause(s)
Root-cause analysis (RCA) is a class of problem-solving methods aimed at identifying the root-causes of problems or events. The practice of root-cause analysis is predicated on the belief that the problems are best solved by attempting to correct or eliminate root-causes, as opposed to merely addressing the immediately obvious symptom.
Listed below are various root-cause analysis techniques, we recommend you use the 5-Whys technique to problem solving. The corrective action form that is provided, is set up to aid 5-Why analysis, but you are free to undertake any of the following:
- 3-Ws (what, where, when);
- 5-Whys (1st Why, 2nd Why, 3rd Why, 4th Why, and 5th Why - and the root-cause);
- 8D Eight Dimensions;
- Failure Mode and Effects Analysis (FMEA & DFEMA);
- Fish-bone Analysis;
- Pareto Analysis;
- Fault-tree Analysis;
- Cause Mapping - draws out, visually, the multiple chains of interconnecting causes;
- Barrier analysis - a technique often used in process industries;
- Change analysis - an investigation technique often used for problems or accidents.
The 5-Whys technique offers some real benefits to organizations with varying degrees of management system maturity:
- Simplicity. It is easy to use and requires no advanced mathematics or tools that allows you to dig deep and find underlying issues rather than using quick-fix solutions;
- Effectiveness. It helps to separate the symptoms from the causes and identifies the root-cause of a problem using evidence-based analysis;
- Comprehensiveness. It aids in determining the relationships between various problem causes and allows you to proactively eliminate problems for good;
- Flexibility. It works well alone and when combined with other quality improvement and troubleshooting techniques such as ones listed above;
- Engaging. By building a culture that embraces progress, by its very nature, it fosters and produces teamwork within and outside of the organization, encourages the reporting of issues without fear or judgement;
- Inexpensive. It is a guided, team focused exercise that seeks to improve and adapt processes to ensure long-term success. There are no additional costs.
Launching a formal root-cause analysis and problem-solving process should always be considered when an issue; such as, undesirable conditions, defects and failures are detected. The decision not to apply the process must be made based on objective evidence of absence of risks!
Implement Corrective Action
When all root and contributing causes have been identified and their effects understood, implement all selected corrective actions. Verify that the planned actions were taken as scheduled and assess their effectiveness in permanently preventing the undesirable condition, situation, non-conformity or failure from recurring. Steps for permanent corrective action (PCA) implementation:
- Implement the permanent corrective action (PCA);
- Implement controls;
- Evaluate the permanent corrective action (PCA) for escape point;
- Remove the immediate containment action (ICA);
- Perform validation;
- Confirm with the customer that the symptom has been eliminated.
To ensure the most effective corrective actions to address the most likely, or critical root causes are taken in consideration of operational and business constraints such as costs, lead time, difficulty of implementation, and resources. Select solutions that optimise value and effectiveness for all stake-holders!
Implement the solutions that have been selected, verify that all actions have been completed to schedule and that they have prevented the undesirable condition, situation, non-conformity or failure from recurring. Plan and implement selected permanent corrective actions. Remove the interim containment action and monitor the long-term results.
Modify the necessary systems, policies, practices and procedures to prevent recurrence of this problem and similar ones. Make recommendations for systemic improvements as necessary:
- Review the history of the problem;
- Analyze how the problem occurred and escaped;
- Identify affected parties;
- Identify opportunities for similar problems to occur and escape;
- Identify practices and procedures that allowed the problem to occur;
- Identify practices/procedures that allowed the problem to escape to the customer;
- Analyze how similar problems could be addressed;
- Identify and choose appropriate preventive actions;
- Verify preventive action and its effectiveness;
- Develop action plan;
- Implement preventive actions;
- Present systemic preventive recommendations to the process owner.
Serious consequences may occur when the underlying symptoms are not addressed, when the quick fix is accepted as a final, permanent solution. Excessive reliance on containment or emergency response action will create a repeating cycle. Problem containment is an addiction that will only get worse until the root-causes are found and addressed.
Establish a review process to ensure corrective actions are completed according to plan and that they continue to be effective over time by confirming you have done what you have planned. Try adjusting the type and number or frequency of additional checks and audits to check that the actions remain effective.
When same problem has been identified or is suspected to occur on same or similar products, processes or data, the same corrective actions must be implemented and their effectiveness verified for all these additional products, processes or data.
The owner of each corrective action, the team leader and all team members should verify the effectiveness of the actions taken to date, and when relevant, the customer. Examples of verification methods include:
- Additional process monitoring until it is demonstrated that the process is stable and capable of consistently meeting requirements (recording and analysis of process parameters and/or product characteristics, SPC, etc.);
- Additional internal audits to specifically verify the effectiveness of the corrective actions;
- Associated metrics showing significant improvement resulting from the corrective actions.
Examples of supporting evidence might include: updated procedures, work instructions, control plans, etc. to show any changes were defined. Additionally, evidence of effective implementation of the changes is also required such as SPC data, inspection records, training records, audit records, etc.
Ineffective Corrective Actions
If the root cause corrective action is not effective, return to Step 1.4 Identify the Root-cause(s) and revisit the analysis process to check if the failure was the root-cause identification and/or the development of the solutions.
If they are effective, evaluate which containment actions may be eliminated (e.g. stop over inspection and over production, return to normal transportation means, etc.) without adversely affecting the product and process output. Record evidence of actions completed and associated results (what works and what does not).
Knowledge & Learning
To document analysis results and changes to make the corrective action permanent, capture and share learning with all the stakeholders to prevent similar undesirable condition, situation, non-conformity or failure occurring on other products, production lines, factories or suppliers.
Identify all that can be shared from the experience that can be transferred across business units, production lines, factories or suppliers. Ensure that you get agreement from appropriate levels of management and other process owners and functions (internally and externally) to launch actions and verify there are implemented and effective.
Keep lessons learned register which includes a summary of content and results of analyses, flow charts, data bases, performance data, main actions and decisions, location where detailed data can be retrieved, difficulties encountered when managing the issue, etc.
Implementing Actions Elsewhere
When the decision is made to implement actions in another business areas, such as; production lines, factories or suppliers, which are not under direct control of the response team, implementation and the verification of effectiveness is not necessarily the responsibility of the team.
Escalation to top management or transfer to another function (procurement, engineering, etc.) may be required to ensure proper leverage and action follow-up.
Providing the number of improvement actions or the number of how many improvement actions are opened or closed to the management review process are not sufficient in assessing the effectiveness of the processes.
Included in this review would be an assessment of any opportunities for improvement of the device, manufacturing process, QMS or the organization itself. An outcome of the review could be the allocation of funding or personnel to a particular area, project or device that the review has identified as not meeting customer and regulatory safety and effectiveness expectations.
More information on PDCA
Free internal audit checklists
Check out our free internal audit checklists. The audit checklist template is just one of the many tools which are available from the auditor’s toolbox that help ensure your audits address the necessary requirements.
Over 8,000 companies and globally recognized brands have relied on our templates to provide a path to improve, collaborate, and to enhance their operations to achieve certification, please see our client list for more information.