Non-Conformance and Corrective Action in ISO 9001: How to Handle Them Properly

A non-conformance is anything that does not meet a requirement. The requirement can come from the customer, from the standard, from a regulation, or from your own procedures. A late delivery, a report sent with the wrong figures, an order processed without the review your process says it needs, a supplier who was never evaluated: all non-conformances. Corrective action is what you do to stop the same thing happening again, which is a different thing from fixing the one in front of you.

ISO 9001 deals with this in two places. Clause 8.7 covers nonconforming outputs: the product or service that went wrong, and what you did with it. Clause 10.2 covers nonconformity and corrective action: why it went wrong, and what you changed. Small businesses tend to be good at the first and poor at the second, and it is the second that auditors write up. (Both sit within the structure covered in our ISO 9001 clauses guide.)

Download the free nonconforming output log and corrective actions log (Excel)

Two matched logs from our ISO 9001 toolkit. The nonconforming output log records the instance: what went wrong, how it was dealt with, whether the customer was told, and the corrective action it led to. The corrective actions log records the cause: immediate correction, root cause, corrective action, owner, due date, effectiveness review and status. Each has two worked examples you can overwrite. No sign-up needed.

Correction versus corrective action

The distinction matters because the standard treats them separately and so will the auditor.

• Correction fixes the instance. You reissue the report, rework the part, apologise to the customer, process the missed order review. It is immediate and it is about the output.
• Corrective action fixes the cause. You find out why the report went out with errors (no peer check before release), change the process so it cannot happen the same way (add a release check), and later confirm the change worked (complaints on that report type have stopped).

You need both, but you do not need corrective action for everything. ISO 9001 says you evaluate the need for action to eliminate the cause. A one-off typo does not need a root cause investigation. A third typo in the same type of document in a quarter does.

Where non-conformances come from

Most businesses think of complaints first, but a healthy system catches problems from several directions:

• Customer complaints and returns
• Internal checks and inspections that fail
• Internal audit findings
• Certification audit findings
• Supplier failures: late, wrong, or below specification
• Staff reporting something that does not look right
• Monitoring data drifting outside limits

If your log only ever contains complaints, the auditor will wonder whether you are finding problems or waiting for customers to find them for you. A log with internal findings in it is evidence that the system is working, not that it is failing.

How to handle a non-conformance, step by step

1. Record it. Date, where it came from, what happened, who spotted it. One line in a log is fine. The commonest failure at this stage is simply not writing it down, because it was fixed on the spot and nobody thought of it as a non-conformance.

2. Contain it. Stop it spreading. If a batch is suspect, segregate it. If a report is wrong, recall it before the customer acts on it. If a process step is being skipped, tell the people doing it today, not at the next team meeting.

3. Correct it. Put the instance right: rework, replace, reissue, re-do, or if none of those are possible, accept it with the customer’s agreement and record that you did. Clause 8.7 asks you to record what the non-conformance was, what you did about it, any concession obtained, and who authorised the decision.

4. Decide whether it needs corrective action. Ask: could this happen again? Has it happened before? What would it cost if it did? If the answer is a shrug, close it as a correction and move on. If not, open a corrective action.

5. Find the root cause. This is where most corrective actions fail. “Human error” is not a root cause; it is a description of what happened. Ask why until you reach something you can change. The report went out with errors because nobody checked it. Nobody checked it because there is no check in the process. There is no check in the process because the process was written when one person did everything. That last answer is something you can act on.

6. Act on the cause. Change the process, the template, the training, the supplier, the tooling, whatever the cause pointed at. Assign an owner and a date. Vague actions (“remind staff to be careful”) are a sign that the root cause was not found.

7. Check it worked. Weeks or months later, go back and look. Has the problem recurred? Is the new step actually being followed? Record the result. A corrective action closed without an effectiveness check is the single most common finding I raise as an auditor, and it is also the easiest to avoid: add a column to the log and use it.

8. Update your risks if needed. If the non-conformance revealed a risk you had not considered, add it to the risk register. Clause 10.2 asks for this explicitly and it is often forgotten.

Worked example

A small consultancy sends a client a report containing figures from a previous version of the spreadsheet. The client spots it.

The correction took a day. The corrective action took a month and prevents the next one. Both go in the logs: the first in the nonconforming output log, the second in the corrective actions log, cross-referenced by ID.

Major or minor?

Your own log does not need to grade non-conformances unless it helps you prioritise, but certification auditors do, and it is worth knowing their language.

• A minor non-conformance is a single lapse or isolated failure against a requirement that does not undermine the system: one order review missing, one training record out of date. You get a corrective action plan to submit and the certificate is not at risk.
• A major non-conformance is a requirement not being met at all, a breakdown of a whole process, or a pattern of minors that adds up to one: no internal audits done this year, no management review, non-conformances fixed but never recorded. A major must be closed before a certificate is issued or renewed.

An observation or opportunity for improvement is not a non-conformance; it is the auditor saying “this works, but it could work better”. You are not obliged to act on it, though it is usually worth doing.

What the auditor looks for

• A log that has entries in it. An empty non-conformance log at a stage 2 audit is not evidence of a perfect business; it is evidence that nobody is recording anything.
• Entries from more than one source, not only complaints.
• Root causes that are causes, not restatements of the problem.
• Corrective actions with an owner, a date and a status.
• Effectiveness checks that were actually done, with a date and a result.
• Linkage: the complaint log, the audit findings and the corrective actions log telling the same story.

What changed in ISO 9001:2026

The requirements of clauses 8.7 and 10.2 are essentially unchanged. What has changed is the emphasis around them. The 2026 edition expects top management to promote a quality culture and ethical behaviour, and auditors cannot audit either directly, so they will look at how non-conformances are handled as the evidence: whether problems are recorded honestly, whether customers are told, whether root causes are investigated rather than blamed on individuals, and whether leadership engages with the trend at management review. A well-kept corrective actions log is now doing double duty as evidence of culture.

Where to go next

The two logs above are part of the free ISO 9001 toolkit, which has the procedure, registers and records for the whole system. Non-conformances surface most often during internal audit, so if you have never run one, start with our ISO 9001 audit checklist, or have us run an independent internal audit for you. If you are building the system from scratch, our ISO 9001 consultancy programme takes you through all of it in five workshops.

Frequently asked questions