ISO 9001 nonconformity and corrective action: major vs minor, root cause and closing findings
By Evin Lim, Founder and Managing Director, AA Alive Sdn Bhd · Published
Key points
- A nonconformity is a requirement that is not met: from ISO 9001, from a customer, from the law or from your own procedures.
- A correction fixes the problem you found. A corrective action removes the cause so it does not happen again. ISO 9001 clause 10.2 requires both where appropriate.
- At a certification audit, a major nonconformity must be closed with evidence before the certification body can issue or keep the certificate. A minor nonconformity needs an accepted action plan.
- Root cause analysis tools such as 5 Whys and fishbone diagrams help avoid actions that only treat symptoms.
What counts as a nonconformity
A nonconformity is the non-fulfilment of a requirement. The requirement can come from ISO 9001 itself, a customer contract, a statutory or regulatory rule, or your own QMS documents. Nonconformities are found through internal audits, certification audits, customer complaints, inspections and day-to-day work.
Major vs minor nonconformity
ISO 9001 does not grade nonconformities. Certification bodies do, following accreditation rules (ISO/IEC 17021-1). Definitions vary slightly between certification bodies, but the principle is the same:
| Major nonconformity | Minor nonconformity | |
|---|---|---|
| Meaning | Affects the ability of the QMS to achieve its intended results | Does not affect that ability |
| Typical examples | A required process is missing entirely; no internal audit or management review done; a pattern of product released without inspection | One training record missing; one document at an old revision; a single late supplier evaluation |
| What the certification body needs | Correction and corrective action, verified before a certification decision (sometimes by a follow-up visit) | An accepted correction and corrective action plan, verified at the next audit |
Correction vs corrective action
- Correction deals with the immediate problem. Example: recalibrate the out-of-date caliper and check the products measured with it.
- Corrective action removes the cause. Example: find out why the calibration was missed, such as no reminder system, and fix that.
Auditors often reject responses that contain only a correction, or that give "retrain the operator" as the corrective action without showing why the training failed.
The corrective action process in clause 10.2
- React: control and correct the nonconformity and deal with the consequences.
- Evaluate the need for action: review the nonconformity, find its causes, and check whether similar problems exist or could occur elsewhere.
- Implement the actions needed.
- Review effectiveness: after enough time has passed, check that the problem has not come back.
- Update risks and opportunities and make changes to the QMS if needed.
- Keep records of the nonconformity, the actions taken and the results.
Root cause analysis with 5 Whys: a worked example
Finding: a customer received a batch with the wrong label.
- Why was the wrong label used? The operator picked the label for a similar product.
- Why did they pick the wrong one? Both labels are stored in the same unmarked tray.
- Why are they in the same tray? The new product was added without a change review of the packing area.
- Why was there no change review? The new product introduction checklist does not include packing and labelling.
- Why not? The checklist was written before the company started private-label packing.
Root cause: the new product introduction checklist is out of date. Corrective action: add packing and labelling to the checklist, separate and label the trays, and add a label check to final inspection. Effectiveness check: review labelling complaints and final inspection records over the following months.
How to respond to certification audit findings
- Agree the facts at the closing meeting and make sure you understand each finding.
- Send the correction, root cause and corrective action plan in the format and within the period your certification body sets.
- For a major nonconformity, attach evidence that the actions are complete, such as updated procedures, training records and sample records.
- Keep all of it in your corrective action log so the auditor can follow it at the next surveillance audit.
We support clients through audit findings as part of our ISO 9001 consulting. For how certification bodies run audits, see ISO 9001 certification bodies in Malaysia.
Frequently asked questions
Does ISO 9001 require preventive action?
Not as a separate clause. ISO 9001:2015 replaced preventive action with risk-based thinking in clause 6.1, so potential problems are handled through your risks and opportunities.
Can I still be certified with minor nonconformities?
Usually yes, once the certification body accepts your correction and corrective action plan. Major nonconformities must be closed and verified first.
What is an observation or opportunity for improvement?
A note from the auditor that is not a nonconformity. It points to something that could become a problem or could work better. You are not required to act on it, but auditors often check what you decided.
What is CAPA?
Corrective and preventive action. The term is common in ISO 13485 and GMP. In ISO 9001:2015 the equivalent is corrective action (clause 10.2) plus risk-based thinking (clause 6.1).
Need help with your ISO 9001 system?
We prepare Malaysian companies for ISO 9001 certification by an accredited certification body. The first consultation is free.