That's the moment quality teams usually realize containing a problem isn't the same as solving it. Worse, a trend buried in your calibration data might be signaling a failure that hasn't happened yet, and ignoring it carries its own risk.
Choosing the wrong response wastes resources you don't have to spare. It also leaves root causes untouched, invites repeat audit findings, and weakens the evidence trail auditors expect to see.
This article breaks down corrective action, preventive action, and the correction/containment steps that often get confused with both. You'll get a clear decision framework, standard-specific terminology, and practical examples you can apply the next time a nonconformity (or a near miss) lands on your desk.
Key Takeaways
- Corrective action eliminates the cause of an existing nonconformity so it doesn't recur
- Preventive action addresses a potential nonconformity before it ever occurs
- Correction and containment control symptoms immediately but don't touch root causes
- Your choice depends on evidence, severity, recurrence risk, and the standard you're audited against
- Every CAPA record needs documented evidence the action actually worked, not just that it happened
Corrective Action vs Preventive Action: Quick Comparison
Both terms get used loosely on the shop floor. ISO's formal definitions draw a hard line between them, and that line matters when an auditor asks you to defend a closed record.
According to ISO's terminology compilation, corrective action is "action to eliminate the cause of a nonconformity and to prevent recurrence," while preventive action is "action to eliminate the cause of a potential nonconformity." One looks backward at something that already happened. The other looks forward at something that hasn't.
| Factor | Corrective Action | Preventive Action |
|---|---|---|
| Trigger | Actual nonconformity, complaint, audit finding, or escape | Risk data, trend, FMEA, or near miss |
| Timing | Reactive | Proactive |
| Goal | Prevent recurrence | Prevent occurrence |
| Typical methods | Root cause analysis, 8D, effectiveness verification | FMEA, risk assessment, trend monitoring, control planning |
| Evidence | Root cause proof, implemented fix, no repeat | Documented risk, implemented controls, reduced exposure |
Terminology Varies by Standard
Don't assume every framework treats preventive action the same way:
- ISO 13485:2016 still keeps corrective action (8.5.2) and preventive action (8.5.3) as two separate clauses, per the ISO 13485:2016 standard
- ISO 9001:2015 folded prevention into Clause 6.1's risk-based thinking instead of a standalone clause
- AS9100D requires corrective action under 10.2.1 and 10.2.2, with retained records of results
- IATF 16949 adds systemic problem-solving requirements under 10.2.3
- ISO 45001 separates immediate incident response from the follow-up review of existing risk assessments
Always confirm which edition applies to your organization before you write procedures around it. Standards get revised, and a clause number that was accurate two years ago may not be today.
What Is Corrective Action?
Corrective action investigates and fixes the cause so a nonconformity does not happen again. Reworking a bad part and isolating defective material are earlier steps. Neither one is corrective action.
Correction, Containment, and Corrective Action Aren't Interchangeable
Think of them as three separate moves:
- Containment stops the bleeding. Hold the material, stop the line, add 100% inspection.
- Correction fixes the specific output. Rework the part, scrap it, replace it.
- Corrective action changes the process, training, equipment, or supplier control so the cause doesn't produce the defect again.
A few good parts right after an adjustment doesn't prove you found the cause. It proves the symptom went away temporarily.
A Practical Corrective Action Workflow
- Define the gap between what should happen and what actually happened
- Determine scope (one lot, one shift, one supplier, or wider)
- Contain the issue
- Investigate root cause with a method that matches the risk
- Plan and implement the process change
- Verify effectiveness over a meaningful time period
Pick your root cause tool based on complexity. A straightforward process drift might only need 5 Whys. A multi-variable escape with customer impact probably needs 8D or fishbone analysis layered with fault-tree thinking. Use the tool for what it's built to do, not as a box-checking exercise.
When corrective action is warranted:
- Recurring defects or process instability
- Systemic audit findings
- Repeat customer complaints
- Supplier failures where severity and recurrence risk justify deeper investigation than a quick fix
Every corrective action record should document the problem statement, affected scope, root cause rationale, action owner, due date, implementation evidence, and the criteria you'll use to confirm it actually worked.
One QMS Learning customer example: a major finding against AS9100D §8.4.3 came from accepting parts from a new supplier without re-qualification. The team classified it as a process-control gap, ran 5-Why analysis, and closed CAPA with verified effectiveness. The four-page corrective action report was accepted by the auditor on first review.
What Is Preventive Action?
Preventive action targets a cause before it produces a nonconformity at all. If you've already had the failure once and you're stopping it from happening a second time, that's corrective action wearing a preventive-sounding label. True preventive action starts from a risk, not an incident.
Where Preventive Action Comes From
Credible sources for preventive action include:
- Risk assessments and FMEA output
- Trend data (calibration drift, scrap rate creep, cycle time variance)
- Near misses and employee observations
- Supplier performance data
- Management review findings
- Design reviews and lessons learned from other processes
A Practical Preventive Action Workflow
- Identify the potential failure mode or weakness
- Assess likelihood and impact
- Determine the underlying cause or contributing condition
- Select and implement controls
- Assign an owner
- Monitor results against defined triggers
Useful tools include process FMEA, risk registers, control plans, preventive maintenance schedules, layered process audits, mistake-proofing, and supplier controls. A DMAIC control plan, for example, tells the next shift exactly what to measure and what to do when a limit gets crossed.
Not every improvement activity qualifies as formal preventive action. Tightening a work instruction because it is a little unclear is good practice, but it's only preventive action in the formal sense if you tie it to an identified risk and track whether the control actually reduces exposure.
Example: a trend shows calibration drift building before any part goes out of tolerance. Treating that as preventive action means assessing the risk, strengthening the calibration or maintenance interval, assigning an owner, and monitoring whether the drift pattern disappears.
When Should You Use Corrective or Preventive Action?
Start by asking one question: has the nonconformity already happened, or is it still a possibility?
- Use corrective action when an actual nonconformity occurred and evidence suggests it could recur or points to a systemic weakness
- Use preventive action when no nonconformity has occurred but credible data shows a failure could happen and the risk justifies acting now
- Use both when an actual issue exposes a broader weakness that could hit other products, sites, suppliers, or customers
Escalate to a formal CAPA process based on severity, frequency, detectability, customer or regulatory impact, recurrence potential, and the resources the fix will require.
Four Scenarios, Four Responses
| Scenario | Right Response |
|---|---|
| Shipment contains parts built to the wrong revision | Contain and correct the shipment, run root cause analysis, fix document/configuration controls |
| Trend shows calibration drift before any out-of-tolerance result | Assess risk, strengthen calibration or maintenance controls (preventive) |
| Near miss reveals an ambiguous work instruction | Revise instruction, check similar operations, retrain, monitor adherence |
| Complaint reveals a design or supplier weakness | Resolve the complaint, investigate the systemic cause, assess need for preventive controls elsewhere |
Before you close either type of action, define your effectiveness measures up front. Review relevant performance data after a reasonable monitoring period. If the data shows the problem or risk is still present, reopen the action rather than filing it as closed.
This is where most teams actually get stuck: not on knowing the definitions, but on picking the right method fast and then proving it worked.
QMS Learning's Root Cause Analysis & CAPA course and AI Workbench were built around that gap. The Workbench diagnoses the problem, routes it to the correct method (5-Why, 8D, FMEA, or supplier CAPA), and drafts the documentation your auditor expects to see. It supports teams that already have quality judgment by speeding method selection and documentation.
If your team needs repeatable corrective and preventive action capability across multiple shifts or sites, QMS Learning's two-seat pilot is a reasonable way to test the workflow before committing to full seat licensing.
Conclusion
Corrective action addresses something that already went wrong and stops it from happening again. Preventive action addresses something that hasn't gone wrong yet but credibly could. Neither one is a substitute for the short-term correction or containment step that comes first.
Getting this distinction right isn't academic. It's the difference between a CAPA record that holds up under audit scrutiny and one that generates a repeat finding next year.
Before you finalize your procedures, verify the exact terminology and documentation expectations in the specific standard your organization is certified against. Clause numbers and requirements shift between editions, and "it's always been done this way" won't satisfy an auditor who's reading the current revision.
Frequently Asked Questions
What is the difference between corrective action and preventive action?
Corrective action responds to an existing nonconformity and eliminates its cause so it doesn't recur. Preventive action addresses a potential nonconformity and eliminates the cause before it ever occurs.
What are examples of corrective and preventive actions?
Corrective action: investigating and fixing the cause behind a recurring customer complaint, not just reworking the defective units. Preventive action: tightening calibration intervals after trend data shows drift, before any part fails inspection.
Is containment the same as corrective action?
No. Containment is an immediate, short-term control, like quarantining suspect stock, that limits damage while the investigation happens. Corrective action eliminates the underlying cause so the problem doesn't return.
Does ISO 9001 require preventive action?
ISO 9001:2015 removed the standalone preventive action clause and embedded prevention into Clause 6.1's risk-based thinking instead. Always verify the current requirements of your applicable edition, since revisions have continued since 2015.
How do you verify that a corrective action was effective?
Define effectiveness criteria before you implement the fix, then review relevant process or quality data after an appropriate monitoring period. Document objective evidence that the issue did not recur, not just that the action was completed.