10.

2 Non-Conformity and Corrective Action

There is a clear link between ISO 9001:2015 Clause 8.7 Non-conforming Outputs and Clause 10.2

Non-conformity and Corrective Action, this guidance document provides a 6-step methodology for

meeting the requirements in each of these clauses. These clauses state the requirements for the

occurrence of a non-conformity and include actions to prevent a similar non-conformity or problems

occurring.

Your organization is required to take whatever action is necessary to control and correct the non-

conformity, and to deal with any resulting impact by determining what caused the non-conformity and

considering whether the potential for a similar problem remains.

This is done by considering whether any further action is required to prevent a similar non-conformity

arising at the same place or occurring somewhere else, at some point in the future and by determining

if similar non-conformities have occurred elsewhere; and consequently, whether it needs to take

similar corrective action.

Taking appropriate action to address the effects of the problem may require a simple correction by the

process owner or operator where it was discovered, or, if a major failure or defect exists, more

significant levels of resource would be needed for problem solving and corrective action.

There may be instances where it is impossible to completely eliminate the cause of the non-

conformity, so in these instances, the best you can do is to reduce the likelihood or the consequences

of a similar problem happening again in order to reduce the risk to an acceptable level.

Any non-conformities and subsequent actions to prevent their reoccurrence and the effectiveness of

the corrective action(s), should be duly documented and retained. Therefore, consideration should be

given to the development and use of a Corrective Action Log to capture this information.

Our new range of audit checklists include the tools needed for corrective action management in accordance with

ISO 9001.

Identify the Problem

Once a problem has been identified through inspection, customer complaints, or audit results, it

should be captured using non-conformity reports (NCRs) or corrective action reports (CARs) in order

to identify who is affected by the problem and what the impact is. Considering the following:

1. What are the operations, products, materials, defects, malfunctions that may characterise the
problem? What is it about?
2. Who is concerned with the problem? Who is reporting the problem? Who is rectifying the
problem? Who is the problem affecting?
3. Where are all the places where the event takes place; shop floor, services, machine, process
step?
4. Where is it seen? Where does it originate?
5. When does the event appear (time, date, when does it start, how long does it last, how often)
6. When is the problem reported defective? When is the problem repaired?
7. Has it occurred before? If yes, what is the history?
8. How do we know there’s a problem (how is it detected)?
9. How does the event appear, how does it stop?
10. How frequently is the problem experienced?
11. How is the effect of the problem being measured (costs, delays, scrap rate, customer
complaints, return rate, concessions, reliability rate, etc)?
12. How is the problem currently addressed? How is it corrected?

This step helps to fully describe a situation, precisely analyse all its elements and gain a common

understanding of them, allowing the definition of an action plan. Ensure that all team members agree

about the definition of the issue and resulting impact.

Define the Problem

The problem description should describe the problems in terms of what, where, when, and how big.

On a flip chart, presentation board, or even paper; write out a description of what you know about the

problem. Try to document the problem and describe it as completely as possible.

The description should contain facts; such as observations and documentary evidence and not

assumptions. All information must be gathered before identifying the root-cause can begin.

Make sure both of the above factors are true before you move to the next step. Consider any new

information that the team may have gathered since completing the initial problem description.

Describe the problem by identifying what is wrong and detail the problem in quantifiable terms.

Define, verify and implement the interim containment action to isolate the effects of the problem from

any internal/external customer until Permanent Corrective Actions (PCA) are implemented.
Establish a Response Team
Identify representatives from functions that may have an influence on the corrective action process,

including the identification of the root causes. Remember to assign responsibilities and objectives to

the team members.

Remember, those performing the job, such as operators, inspectors, drivers, etc., are the best people

to help identify the real causes, don’t leave them out of the team!

The size and composition of the team should depend on the complexity and the impact of the problem.

The composition of the team is not fixed forever and may evolve depending on the analysis results

and the required actions.

New team members should join the team if analysis shows they are identified as being in the scope,

some others will leave if their area is definitely identified as out of the scope.

However, consideration should be made that expending the size of the core team over 6 to 8 members

generally results in less efficiency. When more members or special skills are required, sub teams

should be considered. Don’t forget, root-cause analysis must not be used for assigning blame or

transferring responsibility. In summary, you should establish an investigation team with:

1. Process and/or product knowledge;

2. Allocated time and resources;
3. Authority to solve the problem and implement corrective actions;
4. Skill in the required technical disciplines;
5. A designated Team Leader.

Brainstorming sessions should be used to identify potential causes to investigate each potential cause.

Coordinate parallel activities with different team members to help expedite the process of verification.
Understand the Problem

Once you have reviewed the problem description, you can undertake a comparative analysis. A

comparative analysis will help you identify relevant changes in a change-induced situation. Then you

can reduce the number of possibilities that you must consider to determine root-cause. To complete a

comparative analysis:

1. Ask yourself; what is unique, peculiar, different, or unusual about the symptoms?
2. Consider features such as people, processes, materials, machines and the environment;
3. List all facts without prejudice as to the possible cause;
4. Consider each difference you listed, and look for changes, ask yourself what has changed to give
rise to this difference?
 5. Keep in mind that each difference may not have a corresponding change;
6. List the changes next to the difference;
7. Look at the dates each change occurred;
8. Eliminate some changes if they occurred after the problem started;
9. Consider categories of people, machines, processes or measurements.

If the problem is change-induced, the root-cause must be the result of a change relative to one or

more of the identified changes. It is important to remember that you have not yet moved from the

‘observations’ phase of the process.

Any information you develop during the comparative analysis must be fact based, not opinion based

and must be true only for the symptom’s information. Do not rule out any facts that might be valid

answers. If it is a fact and it answers the question, write it down.

Your organization should first contain the problem by taking immediate corrective action (ICA) and

then evaluating the need for initiating the formal problem-solving process.

Where necessary, provide an emergency response action to protect the customer from the problem,

protect the customer operations and the organisation (to stop the problem getting worse) and verify

that problem does not degrade until the root-causes are known.

An interim containment action is kept in place until a verified permanent corrective action can be

implemented. In some cases, the interim containment action may be the same as or similar to the

emergency response action. An interim containment action provides more opportunity for

investigation.

Conduct trial runs whenever possible. However, in some situations, your verification may simply be a

matter of common sense. For example, if an interim containment action involves stopping the

shipment of all products, you can be sure that customers will stop experiencing the problem.

An interim containment action can be any action that protects the customer from the problem.

However, before you implement an interim containment action, you need to verify that the interim

containment action will work. To verify the interim containment action:

1. Prove before implementation it protects the customer from the problem;

2. Provide a before-and-after comparison;
3. Prove that the interim containment action will not introduce any new problems.
Methods of verification may include:

1. A test to determine the desired performance level;

2. A demonstration that changes eliminated the issue without creating a new problem;
3. A comparison between the interim containment action and similar proven actions;
4. A review to evaluate whether the interim containment action was effective;
5. Assurance that the interim containment action did not introduce a new problem.

Any interim containment action you implement must protect the customer from the problem without

the introduction any new problems. Also, a single interim containment action may not be enough. You

may need to implement more than one interim containment action to fully protect the customer.
Identify the Root-Cause(s)

Root-cause analysis (RCA) is a class of problem-solving methods aimed at identifying the root-causes

of problems or events. The practice of root-cause analysis is predicated on the belief that the

problems are best solved by attempting to correct or eliminate root-causes, as opposed to merely

addressing the immediately obvious symptom.

Listed below are various root-cause analysis techniques, we recommend you use the 5-Whys

technique to problem solving. The corrective action form that is provided, is set up to aid 5-Why

analysis, but you are free to undertake any of the following:

1. 3-Ws (what, where, when);

2. 5-Whys (1st Why, 2nd Why, 3rd Why, 4th Why, and 5th Why - and the root-cause);
3. 8D Eight Dimensions;
4. Failure Mode and Effects Analysis (FMEA & DFEMA);
5. Fish-bone Analysis;
6. Pareto Analysis;
7. Fault-tree Analysis;
8. Cause Mapping - draws out, visually, the multiple chains of interconnecting causes;
9. Barrier analysis - a technique often used in process industries;
10. Change analysis - an investigation technique often used for problems or accidents.

The 5-Whys technique offers some real benefits to organizations with varying degrees of management

system maturity:

1. Simplicity. It is easy to use and requires no advanced mathematics or tools that allows you to
dig deep and find underlying issues rather than using quick-fix solutions;
2. Effectiveness. It helps to separate the symptoms from the causes and identifies the root-cause
of a problem using evidence-based analysis;
3. Comprehensiveness. It aids in determining the relationships between various problem causes
and allows you to proactively eliminate problems for good;
4. Flexibility. It works well alone and when combined with other quality improvement and
troubleshooting techniques such as ones listed above;
5. Engaging. By building a culture that embraces progress, by its very nature, it fosters and
produces teamwork within and outside of the organization, encourages the reporting of issues
without fear or judgement;
 6. Inexpensive. It is a guided, team focused exercise that seeks to improve and adapt processes to
ensure long-term success. There are no additional costs.

Launching a formal root-cause analysis and problem-solving process should always be considered

when an issue; such as, undesirable conditions, defects and failures are detected. The decision not to

apply the process must be made based on objective evidence of absence of risks!

Implement Corrective Action

When all root and contributing causes have been identified and their effects understood, implement all

selected corrective actions. Verify that the planned actions were taken as scheduled and assess their

effectiveness in permanently preventing the undesirable condition, situation, non-conformity or failure

from recurring. Steps for permanent corrective action (PCA) implementation:

1. Implement the permanent corrective action (PCA);

2. Implement controls;
3. Evaluate the permanent corrective action (PCA) for escape point;
4. Remove the immediate containment action (ICA);
5. Perform validation;
6. Confirm with the customer that the symptom has been eliminated.

To ensure the most effective corrective actions to address the most likely, or critical root causes are

taken in consideration of operational and business constraints such as costs, lead time, difficulty of

implementation, and resources. Select solutions that optimise value and effectiveness for all stake-

holders!

Implement the solutions that have been selected, verify that all actions have been completed to

schedule and that they have prevented the undesirable condition, situation, non-conformity or failure

from recurring. Plan and implement selected permanent corrective actions. Remove the interim

containment action and monitor the long-term results.

Prevent Recurrence

Modify the necessary systems, policies, practices and procedures to prevent recurrence of this

problem and similar ones. Make recommendations for systemic improvements as necessary:

1. Review the history of the problem;

2. Analyze how the problem occurred and escaped;
3. Identify affected parties;
4. Identify opportunities for similar problems to occur and escape;
5. Identify practices and procedures that allowed the problem to occur;
6. Identify practices/procedures that allowed the problem to escape to the customer;
7. Analyze how similar problems could be addressed;
8. Identify and choose appropriate preventive actions;
 9. Verify preventive action and its effectiveness;
10. Develop action plan;
11. Implement preventive actions;
12. Present systemic preventive recommendations to the process owner.

Serious consequences may occur when the underlying symptoms are not addressed, when the quick

fix is accepted as a final, permanent solution. Excessive reliance on containment or emergency

response action will create a repeating cycle. Problem containment is an addiction that will only get

worse until the root-causes are found and addressed.

Monitor Effectiveness

Establish a review process to ensure corrective actions are completed according to plan and that they

continue to be effective over time by confirming you have done what you have planned. Try adjusting

the type and number or frequency of additional checks and audits to check that the actions remain

effective.

When same problem has been identified or is suspected to occur on same or similar products,

processes or data, the same corrective actions must be implemented and their effectiveness verified

for all these additional products, processes or data.

The owner of each corrective action, the team leader and all team members should verify the

effectiveness of the actions taken to date, and when relevant, the customer. Examples of verification

methods include:

1. Additional process monitoring until it is demonstrated that the process is stable and capable of
consistently meeting requirements (recording and analysis of process parameters and/or product
characteristics, SPC, etc.);
2. Additional internal audits to specifically verify the effectiveness of the corrective actions;
3. Associated metrics showing significant improvement resulting from the corrective actions.

Examples of supporting evidence might include: updated procedures, work instructions, control plans,

etc. to show any changes were defined. Additionally, evidence of effective implementation of the

changes is also required such as SPC data, inspection records, training records, audit records, etc.

Ineffective Corrective Actions

If the root cause corrective action is not effective, return to Step 1.4 Identify the Root-cause(s) and

revisit the analysis process to check if the failure was the root-cause identification and/or the

development of the solutions.

If they are effective, evaluate which containment actions may be eliminated (e.g. stop over inspection

and over production, return to normal transportation means, etc.) without adversely affecting the

product and process output. Record evidence of actions completed and associated results (what works

and what does not).

Knowledge & Learning

To document analysis results and changes to make the corrective action permanent, capture and

share learning with all the stakeholders to prevent similar undesirable condition, situation, non-

conformity or failure occurring on other products, production lines, factories or suppliers.

Identify all that can be shared from the experience that can be transferred across business units,

production lines, factories or suppliers. Ensure that you get agreement from appropriate levels of

management and other process owners and functions (internally and externally) to launch actions and

verify there are implemented and effective.

Keep lessons learned register which includes a summary of content and results of analyses, flow

charts, data bases, performance data, main actions and decisions, location where detailed data can be

retrieved, difficulties encountered when managing the issue, etc.

Implementing Actions Elsewhere

When the decision is made to implement actions in another business areas, such as; production lines,

factories or suppliers, which are not under direct control of the response team, implementation and

the verification of effectiveness is not necessarily the responsibility of the team.

Escalation to top management or transfer to another function (procurement, engineering, etc.) may

be required to ensure proper leverage and action follow-up.

Management Review

Providing the number of improvement actions or the number of how many improvement actions are

opened or closed to the management review process are not sufficient in assessing the effectiveness

of the processes.
Included in this review would be an assessment of any opportunities for improvement of the device,

manufacturing process, QMS or the organization itself. An outcome of the review could be the

allocation of funding or personnel to a particular area, project or device that the review has identified

as not meeting customer and regulatory safety and effectiveness expectations.