ISO 9001 Clause 10.2. Non-Conformance, CAPA and Continuous Improvement.

ISO 9001:2015 uses two key terms in clause 7.5: «maintain» and «retain». Clauses that say «maintain documented information» require procedures (documents describing how things are done): QMS scope (4.3), quality policy (5.2), quality objectives (6.2), process criteria and methods (4.4), supplier evaluation criteria (8.4). Those that say «retain documented information» require records (evidence of completed activities): management review results (9.3.3), internal audit results (9.2.2), non-conformances and CAPA (10.2.2). Any additional documentation the organisation creates voluntarily falls under clause 7.5.2 control requirements — failing to control it is an automatic non-conformance at audit.

In ISO 9001 audits, non-conformances are classified as major or minor. A major non-conformance (major NC) implies the complete absence of a standard requirement, a systemic failure, or a real risk to product or service conformity. A major NC can lead to suspension or withdrawal of the certificate if not resolved within the agreed timeframe. A minor non-conformance (minor NC) is an isolated, one-off failure that does not compromise the system as a whole. Minor NCs require corrective action within the follow-up cycle but do not put the certificate at risk. Clause 10.2 of the standard requires that every non-conformance — major or minor — is recorded, the root cause is analysed, and a corrective action plan is defined with a named owner and deadline.

CAPA stands for Corrective Action and Preventive Action. In the context of ISO 9001:2015, the term «preventive action» disappeared as a separate concept: it was absorbed into risk-based thinking (clause 6.1). The current standard speaks exclusively of corrective action in clause 10.2. A complete CAPA includes: (1) immediate correction of the problem (eliminating the effect), (2) root cause analysis (5 Whys, Ishikawa, 8D), (3) corrective action that eliminates the cause (not just the effect), (4) owner, deadline, and effectiveness verification criteria. The most common mistake is confusing the correction (putting out the fire) with the corrective action (preventing the fire from starting again).

Clause 8.4 is one of the most dense clauses in the standard and one where the most non-conformances are found due to lack of up-to-date records. It requires: (1) criteria for selecting and evaluating external suppliers (not just initial, but periodic), (2) definition of the type of control applied to each supplier based on the impact on the final product or service, (3) clear communication of requirements to suppliers (specifications, deadlines, expected quality), (4) verification or inspection activities where applicable. The standard differentiates between product suppliers, service providers, and outsourcing of QMS processes. Mandatory documented information includes the evaluation criteria and the results of periodic re-evaluations.

Internal audits (clause 9.2) are planned and carried out by the organisation itself using in-house personnel or contracted external auditors who are independent of the area being audited. The objective is to verify that the quality management system meets standard requirements and is effectively implemented. Results are a mandatory input to management review (9.3). External audits are conducted by accredited certification bodies (BSI, Bureau Veritas, TUV, Lloyd's, SGS, etc.) and are what grant, maintain or withdraw the ISO 9001 certificate. The structure is: initial audit (stage 1 document review + stage 2 on-site), annual surveillance audits, and recertification every 3 years. A robust internal audit programme is the best preparation for external audits.

Clause 9.3 requires management review to include a minimum set of documented inputs. Mandatory inputs (9.3.2): (a) status of actions from previous reviews, (b) changes in external and internal issues (context 4.1/4.2), (c) performance information including: customer satisfaction, achievement of quality objectives (6.2), process performance, non-conformances and CAPA, monitoring and measurement results, audit results, external supplier performance, (d) adequacy of resources, (e) effectiveness of actions taken on risks and opportunities (6.1). Outputs (9.3.3) must include decisions on improvement opportunities, changes needed, and resources required. The meeting minutes are the documented information that auditors request to verify compliance with this clause.