Corrective Action (or CAPA — Corrective Action and Preventive Action) is the single most frequently audited element of ISO 9001 by certification bodies. Done right, corrective actions are what make ISO 9001 genuinely improve your business. Done wrong — superficial fixes without root cause analysis — they become your surveillance audit nightmare. This guide shows you exactly how to do it correctly.
What is ISO 9001 Corrective Action?
ISO 9001 Clause 10.2 requires organizations to take corrective action when a nonconformity occurs. A nonconformity is any failure to meet a requirement — whether from a customer complaint, internal audit finding, process failure, or CB audit observation.
Corrective action is a three-step response to any nonconformity:
- Contain the problem — Fix the immediate issue
- Find the root cause — Understand WHY it happened
- Prevent recurrence — Change the system so it cannot happen again
Many companies do Step 1 but skip Steps 2 and 3. This guarantees the same problem recurs — and the CB auditor will find both the recurrence AND the inadequate corrective action from the first time.
When is CAPA Required?
ISO 9001 requires corrective action for:
- Customer complaints — especially repeated complaints or significant product failures
- Internal audit findings (non-conformities and observations)
- CB audit non-conformities (Major NCs and Minor NCs)
- Product or service non-conformities (defectives, delivery failures, service failures)
- Process failures and near-misses that could cause future nonconformities
- Management review action items
Not every problem needs a full CAPA — minor individual incidents can be handled through operational correction. The threshold for formal CAPA is when a problem is significant, recurring, or has systemic implications.
The CAPA Process — Step by Step
| Step | Action | Timeline |
|---|---|---|
| 1. Record | Document the nonconformity — what happened, when, where, who was affected | Immediately |
| 2. Contain | Immediate action to fix the current problem (correction) — stop further impact | Within 24-48 hours |
| 3. Root Cause Analysis | Investigate WHY the problem happened using RCA methodology | Within 1 week |
| 4. Action Plan | Define specific actions to address root cause — owner, resources, deadline | Within 1 week |
| 5. Implement | Execute the corrective action plan | Per plan timeline |
| 6. Verify Effectiveness | Check that the corrective action worked — problem did not recur | 30-90 days after |
| 7. Close | Document that CAPA is complete and effective | After verification |
Root Cause Analysis Methods
Three RCA methods suitable for Indian MSME companies:
5 Whys (Simplest — recommended for most cases)
Ask "why?" five times to peel back layers of symptom to reach the root cause. Example for a customer complaint about late delivery:
- Why was delivery late? → Because dispatch was delayed
- Why was dispatch delayed? → Because packaging materials ran out
- Why did packaging materials run out? → Because stock was not monitored
- Why was stock not monitored? → Because no one was assigned to check stock levels
- Why was no one assigned? → Because there was no inventory control procedure
Root cause: No inventory control procedure. Corrective action: Create and implement inventory monitoring procedure.
Fishbone / Ishikawa Diagram
Good for complex problems with multiple potential causes. Categories: Man, Machine, Method, Material, Measurement, Environment.
Fault Tree Analysis
Good for safety or complex process failures. Works backward from the undesired event to identify contributing factors.
The Corrective Action Record
Every CAPA must be documented in a Corrective Action Record (CAR). Minimum fields:
- CAR number and date
- Source of nonconformity (customer complaint, internal audit, CB audit, process failure)
- Description of the nonconformity
- Immediate correction action taken
- Root cause analysis method and findings
- Corrective action plan (what, who, when)
- Implementation evidence
- Effectiveness verification result and date
- Closure sign-off
Common CAPA Mistakes to Avoid
| Mistake | Why It's a Problem |
|---|---|
| Correction only, no root cause | Problem recurs; CB auditor finds both the recurrence and the inadequate CAPA |
| Generic root cause ("human error", "lack of attention") | Not actionable — what systemic change prevents "human error"? |
| Corrective action never verified | Cannot confirm if CAPA was effective; open CAPAs accumulate |
| CAPAs left open for years | Major finding at surveillance audit — demonstrates QMS not functioning |
| Not documenting CAPAs at all | No evidence of continual improvement — major QMS failure |
Responding to CB Audit Non-Conformities
When a CB auditor raises a non-conformity (NC) during your audit, you typically have 30 days to submit a CAPA response. The response must include:
- Immediate correction (what was immediately fixed)
- Root cause analysis
- Corrective action plan with evidence of implementation
- Proposed verification method
Elite Assured provides CAPA support for all certified clients — helping you write effective CAPA responses that satisfy CB auditors. Poor CAPA responses are the most common reason for certificate delays and repeated audit findings.