ISO 9001 · Step-by-step series · Article 8 of 10
ISO 9001 Clause 10: Continual Improvement and Nonconformity Management
Clause 10 closes the PDCA cycle of ISO 9001. After planning (clauses 4-6), doing (clauses 7-8) and checking (clause 9), clause 10 closes the loop with "act": managing nonconformities so they don't happen again, and continually improving the system. This guide explains how to manage a nonconformity from detection through to closure with verified effectiveness, which methodologies to use (5 Whys, 8D, Ishikawa), and the real difference between corrective action and preventive action in ISO 9001:2015.
61% of corrective actions are closed without ever verifying their real effectiveness
According to IgeraIndustria 2025 data, more than half of corrective actions in industrial SMEs are "closed" administratively once the deadline passes, without anyone verifying that the root cause was actually eliminated and that the nonconformity has not recurred. This is the single most common clause 10 error, and one of the most frequently cited audit findings.
Structure of clause 10: three subclauses
- 10.1 General: the organization must determine and select opportunities for improvement and implement any necessary actions to meet customer requirements and enhance customer satisfaction.
- 10.2 Nonconformity and corrective action: the full process for managing anything that fails to meet requirements — from detection through to closure with verified effectiveness.
- 10.3 Continual improvement: the organization must continually improve the suitability, adequacy and effectiveness of the QMS, taking into account the results of analysis and evaluation, and the outputs of management review.
10.2 The full corrective action cycle
A nonconformity can originate from many sources: a defective product caught at inspection, a customer complaint, an internal or external audit finding, a process deviation, or management review. Regardless of the source, the process ISO 9001 requires is always the same:
The 10.2 cycle in 6 steps
- React: correct the nonconformity (immediate correction per 8.7) and deal with the consequences.
- Analyze: determine whether similar nonconformities exist, or could potentially occur, in other processes.
- Investigate the root cause: determine the causes of the nonconformity using structured methods.
- Define the corrective action: implement any action needed to eliminate the root cause.
- Review effectiveness: verify that the corrective actions implemented have been effective — the nonconformity has not recurred.
- Update risks and documentation: if necessary, update the risks determined during planning (clause 6.1) and make changes to the QMS.
Root cause analysis methodologies
5 Whys: simple and effective for straightforward nonconformities
The 5 Whys technique consists of repeatedly asking "why?" until the root cause is reached. The name comes from the typical number of iterations, though it can take more or fewer depending on the case.
Practical example — 5 Whys
Problem: The customer received 50 parts with an out-of-tolerance dimension.
Why 1? Because the operator used the dimension from the previous drawing revision (rev. 2) instead of the updated one (rev. 3).
Why 2? Because the rev. 2 drawing was still printed and available at the workstation alongside rev. 3.
Why 3? Because when rev. 3 was distributed, rev. 2 was not withdrawn from the station.
Why 4? Because the document control procedure does not include a step for withdrawing obsolete versions from workstations.
Root cause: The document control procedure (IT-CAL-003) does not provide for the active withdrawal of obsolete documents from workstations when a new revision is distributed.
8D methodology: for complex or high-impact nonconformities
The Eight Disciplines (8D) methodology is the standard in automotive (required by OEM customers) and is used for serious nonconformities that need a structured, team-based analysis. The 8 steps are:
- D1 — Team: assemble a cross-functional team with people who have knowledge of the problem.
- D2 — Problem description: define the problem precisely: what, when, where, who, how much.
- D3 — Containment actions: immediate actions to protect the customer while the root cause is investigated. Quarantine, 100% inspection, customer notification.
- D4 — Root cause analysis: identify and verify the root cause of the problem using techniques such as the Ishikawa diagram, fault tree, or variance analysis.
- D5 — Permanent corrective actions: define the actions that will permanently eliminate the root cause.
- D6 — Implementation and validation: implement the permanent actions and verify that they are effective.
- D7 — Prevent recurrence: update procedures, work instructions, control plans, FMEAs and management systems so the problem cannot recur.
- D8 — Closure and recognition: document lessons learned and recognize the team's work.
Ishikawa (fishbone) diagram: for classifying potential causes
The Ishikawa diagram is a visual tool that helps categorize the possible causes of a problem into 6 categories (the 6Ms): Manpower, Machine, Method, Material, Mother Nature (environment) and Measurement. It is not an analysis method by itself, but a structured brainstorming tool that helps the team avoid overlooking cause categories before moving on to 5 Whys or fault-tree analysis.
Nonconformity form — mandatory record under 10.2.2
| Field | Required content | ISO 9001 clause | Record type |
|---|---|---|---|
| NC code | Unique identifier (e.g. NC-2026-031) | 10.2.2 | Retain |
| Detection date | Date the NC was identified | 10.2.2 | Retain |
| NC description | Exact nature of the nonconformity: which requirement is not met and how it is evidenced | 10.2.2.a | Retain |
| Immediate correction | Action taken to eliminate the NC and manage its consequences (linked to 8.7) | 10.2.1.a and 10.2.2.b | Retain |
| Root cause | Result of the root cause analysis (5 Whys / 8D / Ishikawa) | 10.2.1.b and 10.2.2.c | Retain |
| Corrective action | Actions implemented to eliminate the root cause and prevent recurrence | 10.2.1.d and 10.2.2.d | Retain |
| Owner | Person responsible for implementing the corrective action | 10.2.2 | Retain |
| Due date | Committed date for implementing the corrective action | 10.2.2 | Retain |
| Effectiveness verification | Objective evidence that the corrective action eliminated the root cause and the NC has not recurred | 10.2.1.e and 10.2.2.e | Retain |
The difference between corrective action and preventive action in ISO 9001:2015
This is one of the most frequently asked questions. ISO 9001:2008 had two separate subclauses: 8.5.2 (corrective actions) and 8.5.3 (preventive actions). In the 2015 version, preventive actions disappear as a separate concept.
The logic is this: in ISO 9001:2015, risk and opportunity management (clause 6.1) fulfills the function of the former preventive actions. Instead of waiting for a nonconformity to occur and then acting preventively, risk-based thinking means proactively identifying risks and taking action before they materialize.
In summary:
- Corrective action (10.2): responds to a nonconformity that has already occurred. Goal: eliminate the root cause so it doesn't recur.
- Risk management (6.1) = the new "preventive action": identifies and acts on risks before they generate a nonconformity. It isn't called "preventive action" but fulfills exactly that function.
10.3 Continual improvement: beyond corrective actions
Clause 10.3 requires the organization to continually improve the suitability, adequacy and effectiveness of the QMS. This goes beyond managing nonconformities: it includes proactive initiatives to improve processes, products and the management system itself.
The continual improvement tools most commonly used in ISO 9001-certified industrial SMEs are:
- Kaizen: small, incremental improvements proposed by the people who work directly with the process. A Kaizen suggestion system fuels sustained continual improvement and engages the whole team.
- PDCA applied to improvement projects: using the Plan-Do-Check-Act cycle for concrete improvement projects with an objective, owner, timeline and success metrics.
- KPI data analysis: when an indicator shows a sustained negative trend (not just a one-off deviation), launch a specific improvement project for that process.
- Lessons learned: systematically document lessons from nonconformities, projects and audits, and apply them to similar processes.
- Benchmarking: compare performance against sector references to identify gaps and improvement opportunities.
// IgeraIndustria demo — Corrective action tracking
Quality Manager: Which corrective actions are open with an overdue deadline?
IgeraIndustria: Corrective actions with an overdue deadline: 2 actions. CA-2026-018 (source NC: customer complaint 05/03/2026, due date: 06/03/2026 — 34 days overdue, owner: M. García — process: welding). CA-2026-021 (source NC: internal audit 05/15/2026, due date: 06/15/2026 — 22 days overdue, owner: J. Puig — process: document control). Neither has a recorded effectiveness verification. Recommended action: contact the owners for a status update or escalate to management.
Internal auditor: How many NCs have originated from the purchasing process in the last 12 months?
IgeraIndustria: Nonconformities originating from the purchasing process (July 2025 — July 2026): 7 NCs. Broken down by subcause: 3 from outdated supplier evaluations (8.4.1), 2 from purchase orders lacking complete technical specifications (8.4.3), 1 from material received without a certificate of conformity, 1 from an unapproved supplier used for an urgent order. Trend: 4 in H2 2025, 3 in H1 2026 (moderate improvement). Purchasing is the process with the highest number of NCs this year.
Frequently asked questions about ISO 9001 clause 10
Do you have to open a corrective action for every nonconformity?
No. ISO 9001 clause 10.2 requires a corrective action when the organization determines that "corrective actions are necessary to prevent nonconformities from recurring or occurring elsewhere." For one-off, low-impact nonconformities, the immediate correction (rework or scrap of the product) may be sufficient without a formal root cause analysis. The decision on whether an NC requires a corrective action should be based on its significance, how often it recurs, and its potential impact on the customer and other processes.
When can a corrective action be considered closed?
A corrective action can only be closed once the two closure steps required by 10.2 are complete: (1) implementation of the action is evidenced (procedure updated, training delivered, equipment fixed, etc.) and (2) the effectiveness of the action has been verified through objective evidence that the root cause has been eliminated. Evidence of effectiveness is usually gathered through a follow-up audit of the affected process, or by analyzing process data after a sufficient period of time.
Does ISO 9001:2015 no longer require preventive actions?
Correct. ISO 9001:2015 removed the preventive action subclause. Risk-based thinking under clause 6.1 absorbs that concept: proactively identifying risks and taking action to address them before they materialize into nonconformities is the new "preventive action." In practice, this means the QMS must have a process for identifying and analyzing risks periodically, not just reacting to nonconformities after the fact.
When should you use 5 Whys versus 8D?
5 Whys is suited to nonconformities with a relatively clear root cause and low-to-medium impact: a one-off process defect, a labeling error, a documentation deviation. 8D is more appropriate for complex nonconformities (multiple possible causes), high-impact ones (customer affected, potential product recall), or when the customer explicitly requires it (common in automotive). 8D takes more time and resources but produces more thorough documentation and a more robust analysis.
What's the difference between continual improvement and innovation in the ISO 9001 context?
ISO 9001 refers to "continual improvement" in the sense of incremental, sustained improvements to the QMS and its processes. The standard does not require disruptive innovation. Continual improvement under 10.3 can be as simple as cutting a process cycle time by 5%, improving the response rate on satisfaction surveys, or reducing the number of nonconformities in a specific process. What matters is that the organization has a system for identifying improvement opportunities, prioritizing them, and executing them systematically, with evidence of results.
What happens if the auditor finds that a previous corrective action wasn't effective?
If, during a surveillance or recertification audit, the auditor finds that a nonconformity previously addressed by a corrective action has recurred, this is a new nonconformity — and a more serious one than the original, because it shows the corrective action system itself is not effective. The auditor may escalate the nonconformity from minor to major if the pattern of recurrence is clear. The best protection is genuinely verifying the effectiveness of actions before formally closing them.
Are your corrective actions being closed without verifying real effectiveness?
IgeraIndustria automatically tracks corrective actions, alerts you when one is about to become overdue, and reminds you to record the effectiveness verification before closing it. Nonconformities that don't come back.
See the ISO 9001 solutionEquip IgeraIndustria Qualitat · Updated 2026-07-07 · ISO 9001 step-by-step series: Article 7 — Clause 9 · Article 9 — Audit preparation