Nonconformity & corrective action
Carried over from ISO 9001:2015
Checked — nonconformity and corrective action are unchanged; note that 10.2 is now the last clause of the standard (there is no 10.3).
Checked against the published text on 27 September 2026.
Plain-language summary
When something goes wrong, contain it, fix it, find the real cause, and stop it coming back — then check the fix actually worked. In the 2026 edition this is the last clause of the standard — there is no 10.3.
What the clause is really asking
The clause separates correction (deal with the bad part/situation now) from corrective action (kill the root cause so it doesn't recur). It asks for a documented trail: what happened, what you did immediately, why it really happened, what you changed, and evidence that the change was effective. It also expects you to ask whether the same cause lurks elsewhere.
What auditors look for
Auditors sample NCRs and customer complaints, then test the chain: was containment recorded? Is the 'root cause' genuine (a five-why that ends at 'operator error' is a red flag)? Was the action a system change or just retraining? Months later, did the problem recur — and did anyone formally verify effectiveness before closing? They cross-check that recurring audit findings get escalated into corrective action.
Typical evidence
NCR/CAR register; 8D or A3 reports; root cause analyses (5-why, fishbone); evidence of implemented actions (revised instruction, poka-yoke, changed process); effectiveness verification records; links into FMEA/risk register updates.
How to comply — recommendations
Use a simple one-page CAR form: problem, containment, root cause, action, who/when, effectiveness check date. Force a 30-90 day effectiveness review before closure — calendar it. Ban 'operator error' as a final root cause; ask why the system allowed the error. Feed every closed CAR back into the FMEA or risk assessment.
Common nonconformities
CARs closed the same day they're opened; root cause = 'told the operator'; no effectiveness verification; the same finding appearing audit after audit with a new CAR each time; complaint trends never analysed for systemic causes.
Related clauses
IATF 10.2.3-10.2.6; ISO 14001 10.2; ISO 45001 10.2
In the book
Chapter 10 — Improvement — Closing Loops for a Living treats this clause family in full: what it is really asking, what auditors look for, the evidence that satisfies, how to make it work on a real floor, and where companies stumble.
Resources for this clause
- Article8D problem solving explained: the 8 disciplines, root cause analysis and a free template
- Toolkit · $298D Problem-Solving ToolkitThe full 8D method in one working workbook: a D0–D8 report with Is/Is-Not, the three-legged 5-Why and an Ishikawa canvas built in — you fill the fields, not the theory.
- Free downloadFast Response TrackerLog every open concern and drive it to closure — a live board that shows what's open, overdue, and which 8D step each issue is on.
- Free masterclass · ~14 min8D Problem-Solving MasterclassAll nine disciplines D0–D8 in plain English — three-legged root cause analysis, Is/Is-Not, Ishikawa and the 5-Why, plus the mistakes that get 8D reports rejected.
- Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.
- Course modulePractitioner course — Improvement, Annex A & Your Transition PlanClauses 10.1–10.2 + Annex A
Get the free Fast Response Tracker
Free, instant download. We'll only email you the occasional practical quality update — no spam, unsubscribe anytime.
Qlause provides interpretive guidance only and is not a substitute for the standard. Refer to your licensed copy of the relevant standard for the authoritative text.