Nonconformance and corrective action for small companies

What’s the difference between a correction, a corrective action and preventive action?

A nonconformance is anything that doesn’t meet a requirement, such as a wrong label, an out-of-spec result, or a missed step in a process. A correction deals with that specific instance: you rework the batch, replace the carton, redo the inspection. A corrective action goes further and addresses why it happened, so the same nonconformance doesn’t turn up again next month. Doing the correction but skipping the corrective action is the single most common way a CAPA (corrective and preventive action) process falls short.

Take a mislabelled carton as an example. Pulling the wrong cartons off the line and relabelling them correctly is the correction. It fixes today’s problem. Working out that the label rolls for two similar products were stored next to each other, and moving them apart or adding a barcode check at the labelling station, is the corrective action. It stops the same mix-up happening again next week.

Preventive action, as its own separate clause, no longer exists in ISO 9001:2015, and ISO 9001:2026, the sixth edition published in September 2026, doesn’t bring it back. Both editions replace it with risk-based thinking woven into planning throughout the QMS. You’re expected to think about risks and opportunities before something goes wrong, rather than run a bolt-on "preventive action" process after the fact. ISO 9001:2026 goes a step further and splits risk and opportunity into separate parts of clause 6.1, so opportunity-spotting gets its own explicit attention rather than riding along with risk. In practice, many small teams still find it useful to ask, once a corrective action is in place, whether the same root cause could show up anywhere else in the business. That forward-looking check is where preventive thinking still earns its place, even without a clause named after it.

What does ISO 9001 clause 10.2 require?

Clause 10.2, nonconformity and corrective action, sets out what to do when something doesn’t meet requirements, including a complaint. React to the nonconformity: correct it, and deal with the consequences. Then evaluate whether corrective action is needed to stop it happening again. This means reviewing and analysing the nonconformity, working out its cause, and checking whether similar nonconformities exist or could occur elsewhere. If action is needed, implement it, review how effective it was, and update risks and the QMS itself if the nonconformity revealed something you’d missed. Finally, keep documented information as evidence of the nonconformity, the actions taken, and the results. This requirement is substantively the same in ISO 9001:2026: clause 10 is reorganised so continual improvement, previously its own clause 10.3, merges into clause 10.1, but clause 10.2 itself keeps its number and its content.

Two things in that list are easy to skip under time pressure: deciding whether the same cause could turn up somewhere else, and reviewing whether the action worked. Both are explicit requirements.

The documented information clause 10.2 asks for is exactly what an auditor samples during a corrective action review: the original finding, what was done immediately, what the investigation found, what action was taken and who approved it, and the result of checking it later. A record that’s missing any one of those pieces reads, to an auditor, as a step that was skipped rather than one that wasn’t written down. The same discipline our guide to document control requirements covers for clause 7.5 applies here too.

What’s a lean six-step process for closing a nonconformance?

You don’t need a heavyweight system to satisfy clause 10.2. You need a process that reliably covers each of its steps, in order, every time. A workable version looks like this:

1. Report & record: anyone raises the nonconformance, with enough detail to describe what happened and where.
2. Immediate correction: the specific problem is contained, for example stock quarantined, a batch held, or a wrong document withdrawn.
3. Investigation & severity assessment: someone competent looks into what happened and rates how serious it is, which decides how much scrutiny the rest of the process gets.
4. Root cause analysis: the real cause is identified, beyond the immediate trigger.
5. Corrective & preventive action: an action is agreed and implemented to address the root cause, and approved by someone with the authority to sign it off.
6. Verification: after enough time has passed for the action to prove itself, someone checks the evidence and confirms whether it worked.

The record only closes at the end of step six. A nonconformance marked "closed" the same day the fix went live has been assumed effective. It hasn’t been verified.

Not every nonconformance needs the same weight behind it. A minor labelling slip caught before it left the building might move through all six steps in a day, with a light-touch investigation and a short verification window. A nonconformance that reached a customer, or points to a systemic issue such as a supplier consistently missing spec, deserves a proper investigation, a named approver, and a longer verification period before you’re confident it’s fixed. Rating severity at step three is what lets you make that call consistently, instead of case by case.

Which root-cause methods should you use?

You don’t need a different method for every nonconformance. Two simple techniques cover most small-company cases, and you can reach for something heavier, like an 8D report or an FMEA, when a nonconformance is complex or high-risk.

• 5 Whys: ask "why" repeatedly, starting from the nonconformance itself, until you reach a cause you can act on. "The carton was mislabelled" leads to "why" the operator picked the wrong label, "why" the labels weren’t clearly separated at the workstation, and so on, until the answer is a system issue rather than a person.
• Fishbone (Ishikawa) diagram: useful when a nonconformance could have more than one contributing cause. You sort possible causes into categories such as people, process, equipment and materials, which helps a group spot a cause that a single "why" chain might miss.

How do you verify a corrective action worked, and close the nonconformance?

Set a verification date that gives the action time to prove itself. Checking immediately whether a retrained operator makes the same mistake again tells you nothing useful. Checking a month or a quarter later does. When that date arrives, look at real evidence: has the same nonconformance, or the same root cause, occurred again anywhere it could have? If it hasn’t, mark the action effective and close the record. If it has, mark it ineffective, and go back to root cause analysis rather than closing the record anyway.

This step separates a CAPA process that reduces repeat problems from one that only produces paperwork. Skipping it, or treating it as a formality, is the fastest way to end up fixing the same nonconformance every quarter.

In the mislabelled-carton example above, "did we move the label rolls" only confirms the action happened. Verification means checking, a month or a quarter later, that no mislabelled carton has turned up since, which tells you the root cause was addressed rather than a visible symptom of it.

What are the most common ways a CAPA process fails?

Most CAPA problems auditors find aren’t about the process design. They’re about steps that quietly get skipped under time pressure. The table below covers the ones that show up most often in a small quality team.

Is there CAPA software that fits a small business?

Workflow Manager runs a version of the process above as a standard Nonconformance template, alongside standard templates for CAPA, Audit, Change Control and Document Review, plus your own templates built in the template designer. Approvals are routed by job title (to whoever holds "Quality Manager," for example) rather than a named person who might be on leave when a record needs signing off.

Effectiveness verification is a distinct step with its own due date, closed out with Mark Effective or Mark Ineffective, so a record can’t be closed before it’s been checked. Every stage change, approval and comment is captured in a full audit trail, which you can download as a PDF for an auditor. See Workflow Manager for the full set of templates, or check pricing to see what’s included on each plan.