Nonconformity and corrective action
React to a nonconformity, correct it, find the cause, check whether it exists elsewhere, act in proportion, review the action and keep the record.
01What applies
When a nonconformity occurs, react to it and deal with its consequences, evaluate whether action is needed to eliminate the cause by reviewing the nonconformity, determining its causes and checking whether similar ones exist or could occur, implement whatever action is needed, review the effectiveness of the corrective action, and change the BCMS if necessary. Corrective action must be proportionate to the effects encountered, and documented evidence must be retained of the nature of the nonconformities, the actions taken and the results. The clause also opens with determining opportunities for improvement, which links it to the improvement loop.
02Why it matters
The clause is the difference between fixing a symptom and removing a cause. The extent-of-condition check is the part that saves a multi-site organization from repeating the same failure at every site. The effectiveness review is the part that stops a corrective action from being closed because time passed. Proportion matters too: an over-engineered response to a minor finding wastes the resource the BCMS needs elsewhere.
03What good looks like
Use one form: what happened, immediate correction, cause, where else it could exist, action, owner, date, effectiveness review. Treat human error as a starting point, not a cause. Check the sister sites and the sister processes. Review effectiveness after a defined period with evidence, and change the process if the cause was systemic.
04Evidence an auditor asks for
Take a closed nonconformity and ask what else could have the same cause. If nobody checked, the action addressed one instance.
| Evidence | The record |
|---|---|
| Register | Nonconformity register with source, description and immediate correction |
| Cause | Root cause analysis records, with the extent-of-condition check |
| Action | Corrective action proportionate to the effect, with the resulting change |
| Effectiveness | Effectiveness review evidence, not a closure date |
05Where it commonly fails
- Correction recorded as corrective action, with the cause never examined
- Root cause stated as human error, which stops the analysis
- No extent-of-condition check, so the failure recurs at a sister site
- Effectiveness review missing, so recurrence is the only test
06What to do before the estimate
Add the extent check and the effectiveness review to the form. Reopen the last three closures that have neither.