Guide · Improvement

Corrective action & CAPA, explained

When something goes wrong — a defect, a complaint, an audit finding, an incident — fixing it once isn't enough for ISO 9001. You have to stop it happening again, and prove you did. That's corrective action. Here's how to do it properly, without turning every problem into paperwork.

Correction vs corrective action

These get confused constantly, and auditors love the distinction:

• Correction — fixing the immediate problem. You rework the faulty part, re-do the job, clean up the spill.
• Corrective action — fixing the cause so it doesn't recur. You change the process, the training or the control that let it happen.

ISO 9001 (clause 10.2) requires both: contain the issue, then eliminate the cause. A corrective action that's really just a correction ("we re-did it and told everyone to be careful") is the classic weak finding.

What CAPA means

CAPA is Corrective And Preventive Action. Corrective action deals with a problem that has happened; preventive action deals with one that could happen. ISO 9001:2015 folded prevention into risk-based thinking across the whole standard, so you won't find a separate "preventive action" clause any more — but the term CAPA is still everywhere, and the mindset (fix it, and stop the next one) is exactly right.

The corrective action process, step by step

1. Record the nonconformity. What happened, where, and how you found it.
2. Contain it. Immediate correction — stop the bleeding.
3. Find the root cause. Not the symptom — the underlying reason.
4. Decide the corrective action. A change that removes the cause.
5. Implement it and update any affected documents or training.
6. Verify effectiveness. Check later that it actually worked — this is the step most businesses skip and most auditors probe.

Finding root cause without guessing

Use a structured method, not a hunch:

• 5 Whys — ask "why" repeatedly until you reach a cause you can actually fix. Fast and effective for most issues.
• Fishbone (Ishikawa) diagram — group possible causes (people, process, plant, materials, environment) when the cause isn't obvious.
• 8D — a more formal eight-discipline method for serious or recurring problems, often expected by larger customers.

The test is simple: if you fixed the cause you landed on, would the problem actually stop? If not, keep digging.

Where corrective actions come from

They're not just for defects. Corrective actions should flow from customer complaints, internal and external audit findings, incidents and near misses, nonconforming product or service, and management review decisions. A healthy system has a steady, closed stream of them — an empty corrective-action log usually means problems aren't being captured, not that there aren't any.

Frequently asked questions

Related guides

A plain-English summary of ISO 9001 clause 10.2, not a substitute for the standard.