ISO9001 System Document Package (27) | Nonconforming Product and Corrective Action Procedure (10.2)

Document Description: This procedure corresponds to clause 10.2 "Nonconformity and Corrective Action" of ISO 9001:2015. It is the closing procedure for "problem management" in the quality management system (QMS) and the starting engine for the "A (Improvement)" phase of the PDCA cycle. It is often confused with the division of responsibilities in the "Nonconforming Product Control Procedure" (8.7): 8.7 addresses "how to identify, isolate, and dispose of nonconforming products in this batch," while this procedure answers "why the nonconformity occurred, how to eliminate the root cause, and prevent recurrence." All types of nonconformity information, including customer complaints, audit nonconformities, process anomalies, and supplier issues, ultimately converge into this procedure to form a management loop. The quality of its operation directly determines the number of external audit nonconformities and the proportion of repetitive issues in the company. This procedure is applicable to all manufacturing and service enterprises, especially those where quality issues "repeatedly occur" and corrective actions are superficial. It can be directly applied and tailored according to the organization's scale.

Note: This procedure is a template. Terms such as "our company" and "responsible department" should be replaced with the corresponding department names based on the actual situation of the enterprise.

1. Purpose

To standardize the collection, registration, response, and disposal of nonconforming information within our company, ensuring that identified nonconformities are promptly controlled and corrected. To systematically review and analyze nonconformities, determine the root cause for those requiring corrective actions, and implement corrective actions to eliminate the cause and prevent recurrence or occurrence in other areas. To verify the effectiveness of the measures and, if necessary, update risk and opportunity assessments and modify the QMS, promoting continuous improvement.

This procedure references the following definitions from ISO 9000:2015:

1. Nonconformity: Failure to meet requirements (including product requirements, process requirements, system requirements, customer requirements, and applicable regulatory requirements).
2. Correction: Action taken to eliminate an identified nonconformity, such as rework, repair, downgrading, scrapping, return, exchange, or apology.
3. Corrective Action: Action taken to eliminate the cause of a nonconformity and prevent recurrence, focusing on the "cause" rather than the "phenomenon."
4. Potential Nonconformity: A nonconformity that has not yet occurred but can be anticipated through data analysis and risk assessment. Systematic prevention is handled according to the "Risk and Opportunity Management Procedure," while this procedure focuses on the closed-loop handling of identified nonconformities.

2. Scope of Application

This procedure applies to all nonconformities and their subsequent handling discovered in our company's production and business activities, covering but not limited to:

1. Product Nonconformity: Nonconformities found during incoming inspection, process inspection, final inspection, customer returns, product failure or recall at the customer site.
2. Process Nonconformity: Abnormal fluctuations in the production process, loss of control of process parameters, batch quality issues caused by equipment failures, and delivery delays that do not meet requirements.
3. System Nonconformity: Nonconformities identified during internal audits, second-party audits, and third-party certification audits.
4. Customer and Related Party Dissatisfaction: Customer complaints, claims, service reviews, regulatory notifications, and quality issues reported by related parties.
5. Supplier Nonconformity: Nonconformities in products, services, or processes provided by external suppliers.

The boundary between this procedure and the "Nonconforming Product Control Procedure" (8.7) is as follows: the identification, isolation, review, and disposal of nonconforming products are handled according to procedure 8.7; for any nonconformity that requires elimination of the cause and prevention of recurrence, the corrective action process is initiated according to this procedure. For one-time nonconformities that have been disposed of according to 8.7 and have extremely low residual risk, corrective actions may not be initiated, but the reasons must be recorded in the ledger and approved by the management representative.

3. Responsibilities

The Quality Department has the authority to track and supervise corrective actions under this procedure. No department may refuse, delay, or perfunctorily handle these actions. If the verification fails, the responsible department must re-analyze and re-develop measures until verification is successful.

4. Work Procedures

4.1 Collection and Registration of Nonconforming Information

1. Upon discovering a nonconformity, departments should first follow the "Nonconforming Product Control Procedure" (8.7) for identification, isolation, and review of product nonconformities. Simultaneously, the information should be communicated to the Quality Department within 1 working day.
2. The Quality Department will uniformly register the information in the "Nonconforming Information Registration Ledger," using the numbering rule "NF-Year-Sequence Number" (e.g., NF-2026-015). The registration content includes: discovery date, source (inspection, customer, audit, supplier, etc.), nonconformity description, involved product batch or process, initial disposal method, and whether corrective actions are required.
3. Nonconformities are classified into two levels based on their impact:
   • Minor Nonconformity: Minor impact, one-time occurrence, can be corrected on-site, such as a single appearance defect or individual non-standard record entries.
   • Major Nonconformity: Batch nonconformities, involving functional safety or regulatory requirements, customer complaints or returns, repeated issues of the same type (≥2 times in the same year), and systemic nonconformities (nonconformities identified during internal or external audits).
4. Customer complaints should be handled according to the "Customer-Related Processes Control Procedure" and the "Customer Complaint Handling Work Instruction," and then included in the nonconforming management according to this procedure. Nonconformities identified during internal or external audits should be directly addressed in this procedure for corrective actions.

4.2 Initial Response and Correction (Containment)

1. After confirming a nonconformity, the responsible department should complete containment actions within 1 to 3 working days (24 hours in emergencies) to prevent the nonconformity from expanding or reaching the customer:
   • Isolate, fully inspect, or sort in-process and inventory items; trace and notify customers of delivered products if necessary.
   • For customer complaints, take temporary measures such as exchanges, returns, repairs, or apologies to defuse the situation.
   • For process anomalies, immediately stop the line/machine or adjust parameters to prevent further nonconformities.
2. Containment actions and root cause measures must be managed separately: containment only "stops the bleeding" and does not replace root cause analysis and corrective actions. The containment results should be recorded in the ledger and the "Immediate Disposal" section of the "Corrective Action Handling Form."

4.3 Review, Analysis, and Evaluation of Corrective Action Needs

1. The Quality Department organizes the responsible department and relevant technical departments to review and analyze nonconformities. For major nonconformities, the management representative should chair the review, and the general manager may be invited if necessary. Customer complaints and major quality incidents can be analyzed using the 8D method by a cross-functional team.
2. Root cause analysis must identify the root cause. Recommended tools include:
   • 5Why Analysis: Continuously ask "why" to avoid stopping at surface causes such as "employee negligence" or "improper operation" — continue to ask why employees are negligent (unclear work instructions? missing poka-yoke? insufficient training? excessive labor intensity? ineffective supervision?), until the systemic cause at the process design, documentation, equipment, or management level is identified.
   • Fishbone Diagram (Cause and Effect Diagram): Systematically investigate from the dimensions of people, machines, materials, methods, environment, and measurement.
   • For design defects, update the analysis in conjunction with FMEA (Failure Modes and Effects Analysis). For supplier issues, require the supplier to provide their root cause analysis.
3. Based on the analysis conclusions, evaluate whether corrective actions are necessary. Corrective actions must be initiated if any of the following conditions are met:
   • Major nonconformities (batch, functional/safety/regulatory impact, customer complaints and returns).
   • Repeated nonconformities of the same type (≥2 times in the same year).
   • Nonconformities identified during internal or external audits.
   • Systemic deficiencies (missing documentation, unclear responsibilities, unreasonable process design).
   • Data analysis shows a continuous upward trend in nonconformities.
4. For nonconformities evaluated as not requiring corrective actions (one-time, accidental, and with low residual risk), the evaluation conclusions and reasons should be recorded in the ledger and approved by the management representative before archiving. It is not acceptable to skip the evaluation simply because the nonconformity has been reworked.

4.4 Planning and Implementation of Corrective Actions

1. For nonconformities requiring corrective actions, the Quality Department issues a "Corrective Action Handling Form" (numbered CM-Year-Sequence Number), clearly stating:
   • Nonconformity facts and impact scope.
   • Root cause analysis conclusions.
   • Corrective Action Content: Measures targeting the root cause, which can be developed from technical (poka-yoke, process improvement, tooling modification), documentation (revising work instructions, inspection standards, procedures), management (responsibility adjustments, process optimization), personnel (targeted training and evaluation, capability confirmation), and supplier (requiring supplier rectification and verification) perspectives. Measures should be specific, executable, and verifiable, avoiding vague statements like "strengthen training," "strengthen inspection," or "improve quality awareness."
   • Responsible department and individual.
   • Completion deadline: generally 7 to 30 working days. For major improvement projects, the deadline can be extended and phased milestones set, with a maximum of 90 working days.
2. The corrective action plan is reviewed by the Quality Department and approved by the management representative before implementation. For major investments or cross-departmental resource allocation, approval from the general manager is required.
3. Horizontal Expansion: The responsible department should investigate whether similar risks exist in similar products, processes, equipment, or personnel and include them in the rectification scope to prevent the same cause from recurring in different areas.
4. If the implementation involves document changes, the "Document Control Procedure" should be followed for document revision and version updates. If it involves changes in work methods, training should be conducted and records retained. If it involves changes in risk, the "Risk and Opportunity List" should be updated.
5. For nonconformities involving external suppliers, the purchasing department should issue a "Corrective Action Request Form" to the supplier, requiring them to complete the root cause analysis and rectification on schedule. The verification results should be used as input for supplier performance evaluation.

4.5 Verification of Corrective Action Effectiveness

1. After the measures are completed, the responsible department should submit completion evidence to the Quality Department (revised documents, training records, tooling modification photos, process validation data, continuous batch inspection records, etc.).
2. The Quality Department verifies the effectiveness of the measures within 1 to 3 months (the observation period is determined based on the nature of the issue). Verification methods include:
   • Data Comparison: Compare indicators such as the nonconformity rate and complaint frequency before and after the implementation of the measures (generally using data from the first 3 months after implementation, compared with the same period before implementation).
   • On-site Verification: Check the consistency of poka-yoke devices, new tooling, documents, and on-site operations.
   • Continuous Batch Observation: Track N batches (e.g., 5 to 10 batches) of the improved product to confirm no recurrence of nonconformities.
   • Audit Verification: Combine the next internal audit to specifically verify the maintenance of corrective actions.
3. Verification conclusions are recorded in the handling form as "Effective," "Partially Effective (requires consolidation)," or "Ineffective":
   • Effective: Close the corrective action item.
   • Ineffective or Not Meeting Expectations: Return to the responsible department for re-analysis and re-development of measures, with escalated tracking, until verification is successful.
   • Measures are effective but indicators have not fully recovered: Transfer to the continuous improvement program for tracking.
4. If the deadline is not met, the responsible department should provide a written explanation and request an extension, which must be approved by the management representative. Unjustified delays will be reported to the management representative for supervision and included in the department's performance evaluation.

4.6 Update of Risks and Documentation

1. According to the requirements of clause 10.2.1 e) and f) of the standard, when closing corrective actions, a review should be conducted to determine whether the identified risks and opportunities during the planning phase need to be updated (e.g., adding identified failure modes to the FMEA and "Risk and Opportunity List") and whether the QMS needs to be modified (revising procedure documents, work instructions, inspection standards, control plans, etc.).
2. For design or process changes, the "Design and Development Control Procedure" or "Change Management Procedure" should be followed for change reviews and re-validation to ensure that the measures do not introduce new risks.

4.7 Statistical Analysis and Management Coordination

1. The Quality Department conducts monthly statistical analysis of the "Corrective Action Statistical Ledger," outputting indicators such as the total number of nonconformities and their classification, the number of corrective actions issued, the on-time completion rate, the first-time verification pass rate, and a list of repeated issues.
2. Issues that recur ≥2 times should be escalated: the management representative should organize a special analysis, and if necessary, elevate them to continuous improvement projects (following the "Continuous Improvement Procedure").
3. The corrective action ledger and statistical analysis results should be used as inputs for the "Data Analysis and Evaluation Procedure" and the management review, ensuring a complete evidence chain from "nonconformity → corrective action → verification → statistics → review and decision-making."

4.8 Text Version of the Flowchart

(1) Information Collection: Inspection/Customer/Audit/Supplier/Process Anomalies → Departments report to the Quality Department within 1 working day
      ↓
(2) Registration and Classification: Enter the "Nonconforming Information Registration Ledger" → Determine minor/major
      ↓
(3) Correction (Containment): Isolation/Full Inspection/Exchange/Stop Line → Complete within 1 to 3 working days (24 hours in emergencies)
      ↓
(4) Review and Analysis: Root cause analysis (5Why/Fishbone Diagram/FMEA) → Evaluate the need for corrective actions
      ↓
(5) No Measures Required: Record reasons → Approved by the management representative → Archive (close ledger)
      ↓ (Required)
(6) Measure Planning: Issue the "Corrective Action Handling Form" → Specify measures, responsibility, and timeline → Approve and implement
      ↓
(7) Implementation and Horizontal Expansion: Technical, documentation, management, training, supplier rectification → Investigate similar risks in similar areas
      ↓
(8) Effectiveness Verification: Data comparison, on-site verification, continuous batch observation → Observation period of 1 to 3 months
      ↓
(9) Verification Conclusion: Effective → Close and update risks and documentation; Ineffective → Return for re-analysis (loop)
      ↓
(10) Statistical Closure: Monthly ledger statistics → Management review input → Continuous improvement project

4.9 Forms Referenced

This procedure involves the following forms, with formats as specified in the fourth-level document record form templates:

5. Related Records

1. Nonconforming Information Registration Ledger.
2. Corrective Action Handling Form (including root cause analysis, measure plan, and implementation evidence).
3. Corrective Action Verification Report.
4. Corrective Action Statistical Ledger (including on-time completion rate, verification pass rate, and list of repeated issues).
5. Supplier Corrective Action Request Form and supplier response and rectification materials.
6. Relevant training records, document revision records, FMEA/risk list update records.

These records should be archived according to the "Record Control Procedure," with retention periods as specified in Table 4.9. For corrective actions involving product safety or regulatory traceability, the retention period should comply with regulatory requirements.

6. Related Documents

• ISO 9001:2015 "Quality Management System Requirements" clauses 10.2, 8.7.
• Nonconforming Product Control Procedure.
• Record Control Procedure.
• Document Control Procedure.
• Internal Audit Procedure.
• Customer-Related Processes Control Procedure and Customer Complaint Handling Work Instruction.
• Risk and Opportunity Management Procedure.
• Continuous Improvement Procedure.
• Data Analysis and Evaluation Procedure.
• Management Review Procedure.

Usage Instructions

1. How to Adapt to the Enterprise's Actual Situation

1. Organizational Adaptation: Small enterprises may not have a dedicated Quality Department. In such cases, one person in the quality department can manage the ledger and tracking, and the "management representative approval" step can be directly approved by the general manager. However, the four-step closed loop of "registration → analysis → measures → verification" must not be skipped. The handling form can be simplified to a one-page format, combining the nonconformity description, root cause analysis, measures, and verification into a single form to reduce administrative burden.
2. Process Adaptation: When integrating with the customer complaint process, the "Customer Complaint Handling Work Instruction" can specify "complaint classification standards." Minor complaints can be handled through a simplified path in this procedure, while major complaints must use the 8D report and include complete records from D5 to D8. For internal audits, nonconformities identified can be directly addressed in this procedure without issuing duplicate forms.
3. Industry Adaptation: For the automotive industry (IATF 16949), add response timelines for "customer-specific requirements" (often 24 hours for containment and 90 days for closure) and use the 8D report. For the food industry, link the root cause analysis and measure verification of "unsafe product recalls" with the "Emergency Preparedness and Response Work Instruction." For software and service industries, map "defect/fault tickets" directly to the registration forms in this procedure and use the closure records from defect tracking systems (such as Bug management systems) as verification evidence.
4. Threshold Adaptation: "Recurring ≥2 times" and the observation period (1 to 3 months) are default values. These can be adjusted based on product complexity: high-risk industries are advised to initiate actions for "one major issue," while low-risk, non-critical issues can be set to "recurring ≥3 times in a quarter." However, the criteria for judgment should be documented and available for review during audits.

2. Audit Focus Points

1. External auditors almost always verify clause 10.2: they will sample customer complaints and audit nonconformities and trace the "Corrective Action Handling Form" — focusing on whether "correction" and "corrective action" are distinguished, whether the root cause analysis reaches the root cause, whether the measures are verifiable, and whether there are records of effectiveness verification and post-verification data.
2. Common questions: "Why was this nonconformity not addressed with a corrective action? Where is the evaluation record?" "The measure is 'strengthen training.' What evidence proves the training was effective?" "When was the last similar issue, and why did it recur?" "Were the FMEA, control plan, and risk list updated after verification?" — it is recommended to retain the "reasons for not taking measures (approved by the management representative)" and the "data comparison table" as essential evidence, as these are frequent points of nonconformities in recent audits.
3. Pay attention to the evidence chain between clauses 10.2, 8.7, 9.1.3, 9.3, and 10.3: the disposal records from 8.7 are inputs for 10.2, ledger statistics are included in data analysis, repeated issues and measure completion rates are inputs for management review, and major improvements are elevated to the continuous improvement program. External auditors will follow this chain step by step, and any missing link will result in a "closed loop incomplete" nonconformity.

3. Common Mistakes

1. Correction Without Analysis: After reworking a nonconformity, the issue is considered resolved without opening a form or analyzing the cause, leading to repeated issues each month and a ledger full of "reworked" entries — the core of the corrective action procedure is to "eliminate the cause," not just "handle the product."
2. Stopping at Surface Causes: Treating "employee negligence" or "improper operation" as the root cause, with measures like "strengthen training," "strengthen inspection," or "improve quality awareness," which are neither verifiable nor preventive — the analysis should delve into "why the conditions for negligence exist" and address the systemic issues with poka-yoke, documentation, and process improvements.
3. Measures and Causes Misaligned: If the root cause analysis states "equipment aging," but the measures are "retrain employees," the verification will naturally fail, and auditors will easily spot the inconsistency.
4. Perfunctory Verification: Writing "verification effective" on the day the measures are implemented without any data comparison or on-site evidence; or verifying only "whether the measures were performed" (checking training sign-in sheets) without verifying "whether they were effective" (checking if the nonconformity rate has decreased).
5. Incorrectly Opening or Not Opening Forms: Failing to open forms for minor issues can lead to major risks being overlooked, while opening forms for all minor issues can result in an overload of forms and key issues being buried — the criteria for initiating measures in section 4.3 should be strictly followed, and evaluation records should be retained.
6. Logical Time Conflicts in Records: If the verification date on the handling form is earlier than the completion date of the measures, or if the ledger registration date is later than the form issuance date, the records will be deemed inaccurate by external auditors. The sequence "register → analyze → issue form → verify on schedule" should be strictly adhered to, avoiding the creation of backdated forms.
7. Confusion with 8.7: Using the disposal records from the "Nonconforming Product Control Procedure" as evidence for corrective actions — disposal is "correction," which only proves that the batch of products was handled, not that the cause was eliminated. Both must coexist and complement each other.

True closed-loop corrective actions prevent repeated issues

Knowledge code: 2.3.1

Version: v20260809

Author: QTank QTank is dedicated to providing systematic knowledge, methodologies, and practical tools for quality management professionals, helping enterprises continuously improve their quality capabilities.