10.2 Nonconformity and corrective action: the core mechanism

Clause 10.2 is the most operational and most audited part of clause 10. It applies whenever a nonconformity occurs — including any nonconformity related to an environmental incident, such as a spill, an unauthorized emission, or a breach of a compliance obligation. ISO 14001 explicitly scopes 10.2 to cover incidents, which is a meaningful difference from generic quality nonconformities: an environmental incident is treated as a nonconformity trigger in its own right, even when no internal procedure was technically violated.

When a nonconformity or incident occurs, the standard requires the organization to:

• React to the nonconformity or incident by taking action to control and correct it, and dealing with the consequences — including mitigating adverse environmental impacts.
• Evaluate the need for action to eliminate the root cause(s) of the nonconformity, so that it does not recur or occur elsewhere, by reviewing the nonconformity, determining its causes, and determining if similar nonconformities exist or could potentially occur.
• Implement any action needed, including corrective action determined to be appropriate to the effects of the nonconformity encountered.
• Review the effectiveness of any corrective action taken.
• Make changes to the EMS if necessary, including updates to environmental aspects, risks and opportunities identified in planning (clause 6), if the analysis reveals gaps there.

Corrective actions must be appropriate to the significance of the effects of the nonconformities encountered, including the environmental impacts. This proportionality principle matters in practice: a minor labeling error on a non-hazardous waste container does not require the same depth of root-cause investigation as an uncontrolled discharge to a water course that triggers a regulatory notification.

Root cause analysis: how deep is enough?

ISO 14001 does not mandate a specific root-cause methodology, but it does require that the organization determine the causes of the nonconformity — plural, because environmental incidents frequently have more than one contributing factor (a procedural gap plus a training gap plus a maintenance gap, for example). Common approaches used in industrial EMS include:

• 5 Whys: repeatedly asking why the immediate cause occurred until reaching a systemic factor — adequate for most operational nonconformities.
• Fishbone / Ishikawa diagram: useful when multiple contributing factors (equipment, procedure, training, environment) need to be mapped together.
• Fault tree analysis: reserved for higher-severity incidents where multiple failure paths need to be traced, such as a containment system failure.

Whichever method is used, the evidence trail auditors expect is: description of the nonconformity, cause analysis with a clear method, corrective action decided and assigned to an owner with a deadline, verification that the action was completed, and a follow-up review confirming the action was effective — meaning the nonconformity did not recur within a reasonable observation period.

Similar nonconformities elsewhere: the systemic check

A requirement that is frequently overlooked is the obligation to determine if similar nonconformities exist, or could potentially occur, elsewhere in the organization. If a solvent spill occurs at one storage area because secondary containment was undersized, clause 10.2 requires checking whether the same undersized-containment condition exists at other storage points across the site, or across other sites under the same EMS scope. Limiting the corrective action to the single point where the incident happened, without this systemic check, is one of the most common gaps found in EMS audits.

10.3 Continual improvement: beyond reacting to problems

Clause 10.3 requires the organization to continually improve the suitability, adequacy and effectiveness of the EMS to enhance environmental performance. This is broader than fixing nonconformities — it is about the EMS as a whole getting better at what it is meant to do, independent of whether anything has gone wrong.

In practice, evidence of continual improvement typically comes from several converging sources that a mature EMS ties together:

• Trend analysis of environmental performance indicators (clause 9.1) showing improvement over successive reporting periods — energy consumption per unit produced, waste diversion rate, water withdrawal, or number of near-misses reported.
• Outputs of management review (clause 9.3) that translate into concrete decisions: resource allocation, changes to objectives, changes to the EMS itself.
• Closed corrective actions (10.2) whose effectiveness has been verified, contributing incrementally to a more robust EMS.
• Achievement of environmental objectives (clause 6.2) that were set specifically to improve performance, not merely to maintain compliance.

Note that ISO 14001:2015 does not require improvement to be continuous in the sense of uninterrupted — it requires it to be continual, meaning recurring over time, with the organization periodically reviewing and acting, rather than improving every single day without pause. A management review cycle, an annual objectives review, and periodic corrective action closure together satisfy this intent.

Common audit findings on clause 10

Across EMS certification and surveillance audits, a consistent set of gaps shows up when clause 10 is examined:

• Correction recorded, cause analysis missing: the spill was cleaned up and logged, but there is no record of why it happened or what was changed to prevent recurrence.
• No effectiveness review: a corrective action is closed the same day it is opened, with no follow-up check weeks or months later to confirm the problem did not return.
• Systemic check skipped: the corrective action fixes the exact spot where the incident occurred but never asks whether the same condition exists elsewhere on site.
• Continual improvement treated as a slogan, not a process: the management review minutes mention “commitment to continual improvement” without a single traceable link to an actual change made to the EMS.
• Incidents not treated as nonconformities: near-misses or minor incidents are handled informally and never enter the nonconformity register, breaking the audit trail that 10.2 requires.

Frequently asked questions about ISO 14001 clause 10

Does every environmental incident have to be logged as a nonconformity?

ISO 14001 clause 10.2 explicitly scopes the requirement to cover nonconformities, including any related to an incident. In practice, this means any environmental incident — a spill, an unplanned release, a breach of a permit condition — should enter the same nonconformity process even if no written procedure was technically breached. Treating incidents informally, outside the register, is one of the most frequent gaps auditors identify.

What is the difference between correction and corrective action under ISO 14001?

A correction addresses the immediate effect of the nonconformity — stopping a leak, cleaning a spill, isolating damaged material. A corrective action addresses the cause, so the same nonconformity does not recur. Clause 10.2 requires both: react and correct first, then evaluate and eliminate the root cause where the significance of the nonconformity warrants it.

Is a formal root-cause analysis method mandatory?

No, ISO 14001 does not prescribe a specific technique. It requires that causes be determined and that the corrective action be appropriate to the significance of the effects, including the environmental impacts. Simple tools like 5 Whys are commonly sufficient for routine nonconformities; more structured methods such as fishbone diagrams or fault tree analysis are typically reserved for higher-severity incidents.

How long should nonconformity and corrective action records be retained?

ISO 14001 requires the organization to retain documented information as evidence of the nature of the nonconformities, any subsequent actions taken, and the results of any corrective action, but it does not set a fixed retention period. The organization should define this in its documented information control procedure, taking into account legal retention obligations that may apply to environmental incidents and any related regulatory reporting.

How does clause 10 connect to management review and objectives?

Clause 9.3 (management review) requires top management to review the status of nonconformities and corrective actions as an input, and its outputs typically include decisions relating to continual improvement opportunities under clause 10.3. Clause 6.2 objectives are often adjusted or added as a direct result of what clause 10 analysis reveals — for example, adding an objective to reduce containment-related incidents after a recurring root cause is identified.

Can continual improvement under 10.3 be demonstrated without any nonconformities occurring?

Yes. Clause 10.3 is broader than reacting to failures — it is about the ongoing suitability, adequacy and effectiveness of the EMS. An organization with no significant nonconformities in a given period can still demonstrate continual improvement through trend improvement in environmental performance indicators, achievement of environmental objectives, proactive risk reduction, or enhancements adopted following management review, even in the absence of any corrective action.

Expert ISO 14001 · Updated 2026-07-31 · ISO 14001 step-by-step series: Article 6 — Clause 9: Performance Evaluation · Article 1 — Clause 4: Context of the Organization