Quality Management
Corrective Actions and Root Cause Analysis: Why the Same Finding Comes Back Every Year
Open your nonconformity file from the last three audits. If the same problem appears in it with different dates, and the “corrective action” column says “briefing conducted” or “employee reminded”, then your system records nonconformities but does not resolve them.
This is the most common defect in quality management systems — and it does not come from laziness. It comes from conflating two different things: correction and corrective action.
Key Takeaways
- A correction removes the nonconformity; a corrective action removes its cause. The first puts the product right, the second stops the case from recurring.
- ISO 9001 clause 10.2 requires both — plus evaluating the need for action, analysing the cause, checking whether similar nonconformities exist elsewhere, and reviewing effectiveness.
- “Human error” is not a root cause. It is the point at which the analysis stopped too early.
- Preventive actions were dropped in 2015 and replaced by risk-based thinking — a requirement in clause 6.1, not a separate procedure.
- Method follows severity: 5 Why for simple cases, an Ishikawa diagram when several causes are possible, 8D for a customer complaint.
- Without an effectiveness check there is no closed action. This is the step auditors check most often and the one most often missing.
- ISO 9001:2026 was published on 16 September 2026. Clause 10 keeps its structure, but the expected level of evidence rises.
Correction versus corrective action
A correction is action to eliminate a detected nonconformity. A corrective action is action to eliminate the cause of a nonconformity so that it does not recur. The difference is simple on paper and is missed in almost every report.
| Case | Correction | Corrective action |
|---|---|---|
| A mislabelled batch reached the customer | Recall and relabel | A process change that makes mislabelling impossible or immediately visible |
| An instrument’s calibration has expired | Calibrate now; check measurements from the period | Automatic reminder plus a named owner with a deputy |
| A supplier delivers out of tolerance | Reject the delivery | Revised criteria and a supplier audit |
| An operator skips a routing step | Perform the operation | A change in sequence or control so that skipping stops the flow |
Note the pattern: a corrective action is almost never “training” and almost always a change to the process, the control or the environment. Training is a supplement, not a solution — because it relies on nobody forgetting, and people forget.
What ISO 9001 clause 10.2 actually requires
- React to the nonconformity — take action to control and correct it, and deal with the consequences.
- Evaluate the need for action to eliminate the cause. Not every nonconformity requires a corrective action; a one-off with low impact may close with a correction and a record.
- Review and analyse the nonconformity and determine its causes.
- Determine whether similar nonconformities exist or could potentially occur elsewhere. This is the step that turns a single case into a systemic improvement.
- Implement the action needed.
- Review the effectiveness of the corrective action taken.
- Update risks and opportunities and, if necessary, the management system itself.
- Retain documented information on the nature of the nonconformities, the actions taken and the results.
Step 4 is the secret weapon. If you found one instrument with expired calibration, the question “are there others in the same position” takes five minutes and often turns one finding into a real discovery. Auditors ask exactly that — and when the answer is “we did not check”, the action is not accepted as closed.
Where preventive actions went
Preventive action as a separate requirement was removed in the 2015 revision. The reasoning was that a system built on risk-based thinking is preventive by nature: if you determine risks and plan actions to address them (clause 6.1), you are already doing prevention.
The practical consequence: you do not need a “preventive actions” procedure and a separate register. If you still maintain them, you are most likely maintaining a document nobody fills in. What matters is that the link between nonconformity analysis and the risk register is real.
Root cause analysis: which method, when
| Method | When it fits | Time required |
|---|---|---|
| 5 Why | A single, relatively clear case with one leading cause | 15–30 minutes |
| Ishikawa (fishbone) diagram | Several possible causes across areas — people, machines, methods, materials, environment, measurement | 1–2 hours with a team |
| Pareto analysis | Many recurring defects, when you need to choose which to attack first | Depends on the data |
| 8D | A customer complaint, a serious or recurring problem, automotive supply chains | Days to weeks |
The choice is not a matter of taste but of proportionality. An 8D for a wrong address on one delivery note wastes time; a 5 Why for a systemic customer complaint is not enough.
5 Why in practice
Case: a batch was dispatched without a final inspection record.
Why? The inspector did not complete the record.
Why? They were not on shift, and the stand-in did not know it was required.
Why? The stand-in is not trained on that operation.
Why? The competence matrix does not provide a deputy for final inspection.
Why? Competence planning never considered the scenario of a key person being absent.
Root cause: no deputy planning for critical operations. Corrective action: identify and train deputies for all critical operations, plus a system block preventing dispatch without the record.
Had the analysis stopped at the second “why”, the action would have been “brief the stand-in” — and the same nonconformity would return the next time somebody else was absent.
Why “human error” is not a root cause
When an analysis ends with “operator inattention”, the question left unanswered is: why does the system let one lapse of attention reach the customer? There is almost always an intermediate control that is missing, nominal or easy to bypass.
A useful test: if this employee were replaced tomorrow, would the case recur? If the answer is “probably yes”, the cause is not the person. If it is “no”, you are most likely looking at competence — and then the corrective action lies in how competence is ensured and verified, not in a one-off conversation.
8D: when it is worth it
- D1 — form a team with the necessary competences
- D2 — describe the problem with facts and numbers, not impressions
- D3 — interim containment to protect the customer (holding, sorting, checking stock)
- D4 — identify and verify the root cause
- D5 — choose corrective actions
- D6 — implement and validate
- D7 — prevent recurrence, including on similar products and processes
- D8 — recognise the team and close
The most underrated discipline is D3. The customer judges your response by it — by how quickly you protected their line, not by the elegance of the analysis three weeks later.
How effectiveness is verified
- Data after the change — defects, complaints or deviations over a defined period after implementation, compared with the period before.
- A targeted check — a focused audit of that specific process a few months later.
- Absence of recurrence over a defined period and production volume — valid only if the volume is large enough to be meaningful.
The classic mistake: the report is closed on the day the action is implemented. Effectiveness cannot, by definition, be assessed the same day. Set a review date and write it into the report — that is the difference between a system that improves itself and a system that produces documents.
What changes with ISO 9001:2026
The new version of the standard was published on 16 September 2026 and started the three-year transition period. Clause 10 keeps its structure — nonconformity, corrective action, continual improvement. What changes is the expected level of evidence: the new emphases on quality culture and ethical behaviour mean the auditor will also be interested in how the organisation treats problems.
In practice: can an employee report a mistake without it being risky for them? If not, nonconformities will not reach the system and root cause analysis will be working on incomplete data. More on the transition itself is in our article on ISO 9001:2026.
Five mistakes that turn the process into a formality
Mistake 1: “training” as the corrective action. In more than half the reports I see, the action is a briefing. Training is a valid solution only when the cause really is a competence gap — and then it must be training with verification of the result.
Mistake 2: analysis by one person. The quality manager fills in the report alone because it is faster. But the cause is known to the operator and the process engineer, not to the person holding the file.
Mistake 3: reports only from audits. If nonconformities are raised only when an auditor arrives, the system is ignoring its most valuable source of information — daily problems and customer complaints.
Mistake 4: deadlines without an owner. “By the end of the month” without a name means “never”.
Mistake 5: unverified effectiveness. As above — and the most frequent finding at surveillance audits in this area.
Do your nonconformities keep coming back?
We review your register for the last two years, show where the analysis stops prematurely and train your team on 5 Why, Ishikawa and 8D — using your real cases, not textbook examples.
Conclusion
Corrective actions are where you see whether a quality management system actually works. Any company can hold a certificate. Only the company that reaches the cause has a register in which the problems of 2024 do not reappear in 2026.
Start with one exercise: take the three most expensive nonconformities of the past year and run them through 5 Why again with the people who were there. In most cases the result differs from what the report says — and that is the shortest route to convincing management the process is worth the time. If your auditors are not yet trained to recognise shallow analysis, start with internal auditor training.
Frequently Asked Questions
What is the difference between correction and corrective action?
A correction is action to eliminate the detected nonconformity itself — rework, sorting or recalling a batch, for example. A corrective action eliminates the cause of the nonconformity so that it does not recur. ISO 9001 requires both: first the consequence is contained, then the cause is addressed.
What does ISO 9001 clause 10.2 require?
Clause 10.2 requires the organisation to react to the nonconformity, evaluate the need for action to eliminate its cause, review and analyse the nonconformity and determine its causes, check whether similar nonconformities exist or could occur elsewhere, implement the necessary action, review its effectiveness, update risks and the system where needed, and retain documented information on all of it.
Why are preventive actions no longer in ISO 9001?
Preventive action as a separate requirement was removed in the 2015 revision and replaced by risk-based thinking in clause 6.1. The reasoning is that a system built on determining risks and planning actions to address them is preventive in nature. A separate preventive action procedure and register are not required.
Which root cause analysis method should I choose?
The choice depends on severity. 5 Why suits a single, relatively clear problem with one leading cause. An Ishikawa diagram suits cases where possible causes span several areas. Pareto analysis helps when many defects recur and you must set a priority. 8D is used for customer complaints and for serious or recurring problems.
Can “human error” be a root cause?
No. “Human error” usually means the analysis stopped too early. A useful test is whether the case would recur if the same work were done by a different person. If the answer is probably yes, the cause lies in the process, the control or the environment. If the answer is no, the cause is competence — and the action must address how competence is ensured and verified.
How is the effectiveness of a corrective action demonstrated?
Effectiveness is demonstrated with data after implementation — defects, complaints or deviations over a defined period compared with the period before — with a targeted internal audit of the process a few months later, or with the absence of recurrence over a sufficient production volume. A report closed on the day of implementation contains no evidence of effectiveness.
Does every nonconformity require a corrective action?
No. ISO 9001 requires the need for action to eliminate the cause to be evaluated. A one-off nonconformity with low impact and a clear random cause may close with a correction and a record. What matters is that the evaluation was made and documented, rather than skipped automatically in every case.