Nonconformities under ISO 17025: from nonconformity to corrective action
A nonconformity under ISO/IEC 17025 is a situation in which work or a system does not meet a requirement of the standard or of your own procedures. You record the nonconformity, correct it immediately if you can, find the cause, and take corrective action to prevent recurrence. The standard distinguishes between work that does not conform (clause 7.10) and corrective actions for the system (clause 8.7). Both have a place in the quality system, and the Dutch Accreditation Council (RvA) looks at how you handle them during an assessment. An internal audit, as described in the checklist, often produces the first nonconformities.
This is not about blame. It is about the difference between a fault you fix and a fault you prevent.
What is the difference between a correction and corrective action?
A correction resolves the current problem. Corrective action makes sure it does not happen again. Many laboratories stop after the correction, and that is the biggest difference from a well-functioning system.
| Term | What it is | Example |
|---|---|---|
| Correction | The direct repair of a nonconformity | A report that mistakenly names the wrong method is reviewed and reissued |
| Corrective action | Removing the cause so the nonconformity does not return | The report template gets a fixed field for the method, checked by a second person |
| Action on a risk (clause 8.5) | Addressing a risk or opportunity before something goes wrong | Setting a calibration reminder before the interval expires |
The 2017 version no longer has a separate concept of preventive action. Looking ahead is part of how you address risks and opportunities (8.5). The RvA expects documented measures for this, which you check for effectiveness (INF002, 8.5). Corrective action remains the evidence that your system learns.
Five steps from nonconformity to closure
Record the nonconformity
Write down what happened, when, who was involved, and which work or requirement was affected. A short description is enough, as long as it is factual. No judgement about individuals.
Correct immediately where you can
Remove the incorrect result from circulation, repair the report or have the measurement repeated. Record what you did and when. If a client has already received a report, inform them.
Find the cause
Ask “why” five times, or use another root cause method. The cause often lies in a procedure, a training course, a device or a form, not in one person. If the nonconformity affects a measurement result, also see the page on measurement uncertainty.
Choose and carry out a corrective action
Describe the action, who carries it out and when. An action without an owner and a date is not complete. Preferably choose an action that changes the system, not only the person.
Check that it works
After a set period, check whether the nonconformity has come back. Only close the action if it has not. Record the result. The RvA requires every corrective measure to be assessed for effectiveness. For a minor nonconformity, that assessment may be less in-depth (INF002, 8.7.1).
Fictional example: a wrong unit in the reporting
A fictional water quality laboratory discovers that three reports show the wrong unit. The result is correct, but the unit is milligrams per litre instead of micrograms per litre. A client discovered the nonconformity.
| Step | What happens (fictional) | Evidence |
|---|---|---|
| Record | Nonconformity: three reports with the wrong unit, found by a client | Nonconformity form with date and report numbers |
| Correction | Three reports withdrawn and reissued, client informed | New reports referring to the old ones |
| Cause | The unit is retyped by hand from the method, and the template has no fixed unit | Analysis using the five whys |
| Corrective action | The template gets a fixed unit per method, and a second person checks each report | Amended template and check rule |
| Check | After three months, no new nonconformities regarding units | Control report from the quality officer |
The laboratory has done more than repair three reports. The system now makes this error harder to make.
A nonconformity that you find and resolve yourself is a sign that the system works. A system with no nonconformities at all raises suspicion, because it often means nobody is looking closely.
A result looks wrong: may you simply measure again?
An analyst gets a result that does not match expectations. There is a strong temptation to measure the sample again and let the first number drop out. The RvA says that is not automatically allowed (INF002, 7.8.1.2). First investigate what went wrong, following 7.10 and 8.7.
If you report both results, that is acceptable, provided your method is set out in a procedure and you have agreed it with the client. Fictional example: a nitrate measurement gives an outlier. The laboratory identifies a contaminated cuvette as the cause, records this and measures again. Both measurements and the cause are kept in the file.
When is a nonconformity serious enough to report?
Not every nonconformity is equally serious. A typing error in a report is different from a measurement with an expired calibration. Use a simple classification so staff know what to do.
- Minor: no effect on the result, can be corrected directly. Record and resolve.
- Medium: possible effect on a result, but not certain. Investigation and a decision by the responsible person.
- Major: an incorrect result has been issued or a system is not working. Report directly to management and inform the clients involved.
Common mistakes
- Not recording a nonconformity because it is small. Small nonconformities are the evidence an auditor looks for.
- Cause = “human error”. That is rarely the real cause. Dig deeper into the procedure or the equipment.
- Action without a check. An action that has not been checked is only a promise.
- Not feeding nonconformities back. The management review needs to see the trends. Otherwise the system does not learn.
Frequently asked questions
Must every nonconformity lead to corrective action? Not always. For a small, one-off correction with no clear cause, the correction may be enough. Do record the decision and your reasoning.
What if a client has already used the result? Inform the client as soon as possible, with an explanation and a corrected result. Record the notification and how you handled it.
How long may a corrective action stay open? Your own procedure sets this. An action that stays open for months without progress stands out during an audit.
Is a nonconformity in an internal audit the same as one for the RvA? The concept is the same, but the context differs. For the RvA, the focus is the effect on accreditation. The RvA calls the most serious category an A-level nonconformity. Examples in ASR106 include reported incorrect results, missing quality controls and misuse of the accreditation mark. Your internal audit is the moment to test the system in advance.