Nonconformities and corrective actions under ISO 9001

Nonconformities are part of every business. Something goes wrong, a product does not meet the specification, or a customer complains. ISO 9001 does not require that you never make mistakes. It requires that you record them, investigate the cause and prevent them from happening again. Clause 8.7 covers nonconforming output during delivery. Clause 10.2 covers corrective actions afterwards. Together they form the backbone of continual improvement, alongside the internal audit and the management review. On this page we explain how to approach this in practice, with an example register table and an explanation of root cause analysis.

ISO 9001 uses the term “nonconformity” for any case where something does not meet a requirement. That can be a customer requirement, a process requirement or one of your own work instructions.

Nonconforming output (clause 8.7)

Clause 8.7 covers the moment you discover during delivery that something does not meet requirements, before you deliver it to the customer. Think of a product outside the tolerance, a service that does not match the order, or an intermediate product with a fault.

What do you do with nonconforming output?

The standard gives four possible actions:

Correct: fix the fault (rework the product, redeliver the service)
Segregate or control: set the nonconforming product aside so it is not delivered by mistake
Inform the customer: if the nonconformity cannot be fixed or the product has already been delivered
Ask for permission to deviate: if the customer agrees to accept a nonconforming product (concession)

Which action you choose depends on the situation. Sometimes you combine them.

What do you record?

The standard requires that you record:

What the nonconformity was
Which action you took
Who approved the action (always required when a specification is deviated from)

Corrective actions (clause 10.2)

Clause 10.2 goes further than immediate repair. It is about preventing recurrence. A corrective action (CA) is an action that removes the cause of a nonconformity, not only its effect.

The difference between a correction and a corrective action

Term	Definition	Example
Correction	Repair of the nonconformity itself	Scrapping a damaged product and making it again
Corrective action	Addressing the cause	Investigating the cause and adjusting the way of working

A correction is necessary but not sufficient. Without a corrective action, the risk of recurrence stays the same.

Steps for a corrective action

Record the nonconformity

Write down what went wrong, when, where, and what the consequences were.

Fix it immediately (correction)

Resolve the immediate situation. Make sure the customer or the process suffers no further harm.

Identify the cause (root cause analysis)

Find the real cause, not only the symptom. Use a structured method for this (see below).

Decide on the corrective action

Which action prevents this from happening again? Appoint someone responsible and set a deadline.

Carry out the action

Implement the measure.

Assess effectiveness

Check after some time whether the measure has worked. Has the problem not come back?

Close the record

Record all steps and the verification in the register.

Example nonconformity register

Below is a practical layout you can use as a register format. Each row is one nonconformity.

No	Date	Description	Source	Immediate correction	Cause	Corrective action	Responsible	Deadline	Effectiveness	Status
CA-2026-01	12 March 2026	Delivery to customer X three days late	Customer complaint	Apology, express delivery arranged	Planning did not take the supplier’s lead time into account	Add supplier lead times to the planning system	Planner	1 May 2026	Yes, 0 late deliveries in Q2	Closed
CA-2026-02	28 April 2026	Measurement protocol not carried out on project Y	Internal audit	Carried out afterwards	Employee did not know the protocol was mandatory	Add the protocol to the instruction and briefly brief the team	Quality manager	15 May 2026	-	Open

You do not need a complicated system. A shared spreadsheet or a simple table in your quality manual works well, as long as the findings are easy to find and the follow-up is traceable.

Root cause analysis: finding the cause

A root cause analysis looks for the real cause of a nonconformity, not the first obvious one. Two simple methods:

1. The 5 whys method

Ask “why” five times to get deeper:

Why was the delivery late? Because the planning was wrong.
Why was the planning wrong? Because the supplier’s lead time had not been entered.
Why had that lead time not been entered? Because the planner did not know it.
Why did the planner not know it? Because there was no handover after the purchaser fell ill.
Why was there no handover? Because there is no procedure for cover during sickness absence.

Root cause: a missing cover procedure for sickness absence.

2. Fishbone diagram (Ishikawa)

Useful for more complex problems. Group possible causes into categories: People, Machines, Methods, Materials, Environment. Brainstorm per category and find which contributes most.

For most everyday nonconformities, the 5 whys method is sufficient.

Link with the complaints register

Customer complaints are a specific type of nonconformity. They fall under clause 10.2 when it comes to correction and prevention. The standard also explicitly mentions customer satisfaction as a performance indicator (9.1.2).

Link your complaints register to your nonconformity register. Every complaint that is not a one-off deserves a corrective action with a root cause analysis. This shows the auditor that you learn systematically from mistakes.

Complaint	Nonconformity	Corrective action
Customer complains about slow response time	Response time exceeded	Adjust the procedure: maximum 24 hours response, measured monthly
Invoice contains an incorrect amount	Invoicing process not followed	Training and a check before sending

Continual improvement (clause 10.3)

Besides resolving nonconformities, the standard requires that you “continually improve the suitability, adequacy and effectiveness of the quality management system”. This goes beyond reacting to mistakes.

Continual improvement in practice:

Analyse trends in nonconformities (what keeps coming back?)
Decide on improvements in the management review
Take improvement suggestions from employees seriously
Turn the results of internal audits into actions

A nonconformity that comes back three times is not bad luck. It is a system problem. The auditor looks for patterns in your records.

Next step

See how the results of your nonconformity register feed into the management review under ISO 9001, or read the full requirements of ISO 9001 for the context of clauses 8.7 and 10. You can read more on how the internal audit detects nonconformities on that page.