That gap between what people expect and what the standard actually says causes real confusion. Earlier editions of ISO 9001 had a dedicated preventive action clause, separate from corrective action. The 2015 edition folded that thinking into the rest of the quality management system instead of keeping it as its own line item.
This article covers clause 10.2, clause 8.7, risk-based thinking under clause 6.1, the records an auditor will actually ask for, and how to run a CAPA-style process without inventing paperwork the standard never asked for. (One note: ISO's catalog now shows a newer edition replacing 2015, but most currently certified organizations still operate under 2015 requirements, which is what this article addresses.)
Key Takeaways
- The standalone preventive action clause is gone; prevention now runs through risk-based thinking and continual improvement instead.
- Clause 10.2 requires a response to nonconformities, cause determination, action, effectiveness review, and QMS updates when needed.
- CAPA is useful shorthand for a workflow, not a named ISO 9001:2015 requirement.
- Clause 8.7 governs nonconforming output control. It overlaps with CAPA but isn't the whole corrective-action process.
What ISO 9001:2015 Actually Requires
Why the Standalone Clause Disappeared
Earlier ISO 9001 editions treated preventive action as a separate box to check, distinct from fixing an existing problem. The 2015 revision removed that box entirely. Instead, the drafting committee built prevention into the structure of the whole standard: planning, operational control, performance evaluation, and improvement all now carry a piece of that preventive intent.
This wasn't a softening of the requirement. It was a redistribution of it. Risk-based thinking under clause 6.1 is the clearest expression of that shift.
What Clause 10.2 Actually Covers
When a nonconformity happens, clause 10.2 expects the organization to:
- Respond to the nonconformity and control or correct it
- Deal with the consequences it caused
- Evaluate whether action is needed to eliminate the root cause so it doesn't happen again
- Implement that action if it's warranted
- Review whether the action actually worked
- Consider whether similar nonconformities exist elsewhere, or could occur
- Update risks, opportunities, or the QMS itself if the situation calls for it
None of this requires a document titled "corrective action report." It requires that these activities happen and that evidence of them exists somewhere in your system.
Connecting Clause 10.2 to Risk-Based Thinking
Clause 6.1 isn't a parallel requirement sitting next to clause 10.2. It feeds into it. Risks and opportunities identified during planning should shape process controls, set improvement priorities, and drive preventive measures before a nonconformity ever occurs.
A risk register that nobody reviews, assigns, or updates isn't risk-based thinking. It's a spreadsheet. According to ISO's risk guidance, no specific format is mandated for documenting risk determinations. The format matters far less than whether the organization actually acts on what it finds.
Clause 10.3 rounds this out by requiring continual improvement in the suitability, adequacy, and effectiveness of the QMS as a whole, not just reactive fixes after something breaks.
What the Standard Does Not Require
ISO 9001:2015 does not prescribe:
- A specific CAPA form or template
- Named CAPA software
- A mandatory root-cause methodology
- A fixed number of approval levels
- A separate "preventive action report" format
Organizations can build whatever process fits their size and risk profile, as long as it produces objective evidence.
How Correction, Corrective Action, Preventive Action, and CAPA Fit Together
These four terms get used interchangeably on shop floors constantly, and that's where most of the confusion starts.
Correction is the immediate fix. If incoming inspection flags an out-of-tolerance bore on three lots from one supplier, segregating that suspect stock while the investigation continues is a correction. So is fixing a typo in a traveler or restoring a machine to its correct setpoint.
It stops the bleeding. It doesn't ask why the bleeding started.
Corrective action addresses the cause of that existing nonconformity, specifically to stop it from happening again. Reworking the bad parts isn't corrective action. Figuring out why the supplier's tooling drifted, and fixing that, is.
Preventive action, in its traditional sense, is action taken before a nonconformity occurs, aimed at a potential cause rather than an actual one. ISO 9001:2015 expresses this intent through risk-based controls, trend analysis, planning reviews, change management, and lessons learned from past events rather than a dedicated clause.
CAPA is the umbrella term quality professionals use to describe the connected workflow: intake, correction, root-cause analysis, corrective action, risk-based prevention, and effectiveness verification, all tied together with evidence. It's practical shorthand, not an ISO clause name.
Here's how the four compare side by side:
| Concept | Trigger | Timing | Objective | Typical Evidence |
|---|---|---|---|---|
| Correction | Existing issue | Immediate | Contain or fix the problem now | Disposition or correction record |
| Corrective action | Existing nonconformity | After cause analysis | Prevent recurrence | Cause analysis, action taken, effectiveness review |
| Preventive action | Potential issue or risk | Before occurrence | Reduce exposure or prevent occurrence | Risk evaluation, controls, monitoring |
| CAPA | Organizational workflow | Ongoing | Coordinate related actions | Varies by clause and action type |
Keeping a CAPA procedure voluntarily is perfectly reasonable, and most quality teams do, since it creates a consistent workflow everyone understands. Just make sure it fits your actual capacity.
A CAPA process that promises 30-day closures your team can't consistently hit will cause you more audit trouble than not having a CAPA label at all.
Where Clause 8.7 Fits
Clause 8.7 requires organizations to identify and control outputs that don't conform to requirements, so they're not accidentally used or shipped. The appropriate response depends on the situation; the standard doesn't dictate one fixed method.
Nonconforming Output vs. Corrective Action
These two often get treated as the same thing. They aren't.
- Clause 8.7 handles the immediate disposition of the affected output, meaning what happens to this part, this batch, this service failure.
- Clause 10.2 handles whether the organization eliminates the underlying cause and prevents the problem from recurring.
Disposing of a bad batch correctly says nothing about whether you've stopped the next batch from being bad too.
Practical 8.7 Controls
Common responses depend on the situation and your procedures:
- Identification and segregation of the nonconforming item
- Containment to prevent further processing or shipment
- Rework or correction, with conformity reverified afterward
- Concession, with proper authorization, not an informal shrug
- Return or suspension of the service
- Customer notification when the output already left the building
Why Not Every Nonconforming Output Needs a Full CAPA
A nonconforming-output record can become an input to a corrective action. It doesn't automatically require one.
A single scratched part caught at final inspection with an obvious, isolated cause may just need a disposition record. A recurring dimensional failure across three shifts is a different animal entirely, and that's where cause analysis under 10.2 earns its keep.
Either way, document the disposition clearly. Certification bodies vary in how strictly they expect concessions to be recorded, so confirm your registrar's expectations rather than assuming one method fits every case.
What Evidence Should an ISO 9001 Auditor Be Able to See?
Clause 10.2 is specific about retained information: the nature of the nonconformity, the actions taken, and the results of the corrective action. That's the minimum an auditor will look for directly.
Evidence Beyond the Word "Preventive"
Plenty of records demonstrate proactive, risk-based control without ever using the word "preventive." These include:
- Risk assessments and trend analysis
- Process-control and calibration records
- Supplier evaluations and audit results
- Training records tied to identified skill gaps
- Change-management documentation
- Internal audit findings and resulting improvement actions
None of these need a dedicated log labeled "preventive action" to count.
Proving Effectiveness, Not Just Completion
A root-cause record documenting an out-of-tolerance bore across three lots should show the applicable requirement, the measurement results, the affected lots, the dates, and whether the measurement system itself was checked. That's a real record an auditor can trust. A few good parts right after an adjustment doesn't prove the fix stuck.
According to ISO's audit guidance, closure requires objective evidence that the action was implemented and effective, not just that assigned tasks got checked off.
A useful evidence structure links:
- The issue and immediate correction
- The cause analysis and action owner
- The due date and effectiveness criteria
- Any related risk or opportunity
- The final review confirming the result held
Weak Evidence to Avoid
- "Operator error" listed as the cause with no further digging
- Verbal fixes with no documentation at all
- Action plans with no defined effectiveness criteria
- Closure recorded without checking whether the problem actually recurred
How to Build an Audit-Ready Process Without a Separate Preventive Action Procedure
Start with intake and triage. Complaints, audit findings, process deviations, supplier issues, nonconforming outputs, trend data, and employee-reported risks all need a front door. Set criteria for when a quick correction is enough versus when a formal corrective action or broader risk treatment is justified.
A Disciplined Investigation Sequence
- Write a clear problem statement
- Contain the immediate issue
- Gather objective evidence rather than assumptions
- Identify the systemic cause, not just the symptom
- Check whether the same condition exists elsewhere
- Choose an action proportionate to the risk and impact
Treat correlation with suspicion here. Noticing that two events happened around the same time isn't the same as proving one caused the other, and that's a mistake that shows up constantly in root-cause records that don't hold up under questioning.
Build Risk-Based Prevention Into Routine Work
- Update process risks after significant findings
- Watch trend data for deteriorating performance before it becomes a nonconformity
- Review risks during change planning, not after the change breaks something
- Convert high-priority risks into assigned controls with effectiveness checks
Assign owners and deadlines, but keep the investigation cross-functional. Quality, operations, engineering, maintenance, and purchasing often each hold a piece of the real cause.
Define closure criteria before you start implementing, not after. That means evidence the action was completed, the process was updated where needed, affected staff were informed or retrained, and the result actually matches the intended outcome.
This is where a lot of teams get stuck, not because they don't understand the concepts, but because nobody on the floor has practiced picking the right tool under pressure. QMS Learning's General Manufacturing Quality pathway builds that judgment directly. Its AI Workbench includes a Method Router that walks a team through root cause, CAPA, and related problem-solving plays before generating the working document.
The organization still has to review the output and apply its own procedures. The tool shortens the path to a defensible draft; it doesn't replace the review.
Common Misinterpretations to Avoid
"Preventive action was deleted, so ISO 9001 doesn't care about prevention anymore." The label changed. The expectation didn't. Risk-based planning and proactive control are more embedded now than when preventive action had its own clause.
"Every nonconforming output needs a full CAPA." A risk- and impact-based response is what the standard expects, not a blanket policy that treats a scratched part the same as a recurring dimensional failure.
"Correction, corrective action, and containment are interchangeable." They're not. Containing suspect stock from one supplier lot is correction. Figuring out why that supplier's process drifted, and fixing it, is corrective action. Mixing the two up on paper is one of the fastest ways to draw auditor attention.
"Completing the assigned tasks proves effectiveness." It proves the tasks got done. It says nothing about whether the actual problem went away, which is why closure without a recurrence check is a recognized audit risk.
"A CAPA form alone demonstrates conformity." It doesn't. A binder full of completed forms rarely survives thirty minutes of pointed questioning from a Tier 1 customer audit team. The quality of the investigation and the evidence behind it matters far more than the document's title.
Conclusion: What the Standard Actually Says
ISO 9001:2015 doesn't require a standalone preventive-action clause or a formally named CAPA system. It does require an effective response to nonconformities and a proactive, risk-based quality management system running underneath everything else.
The practical model is straightforward:
- Control nonconforming outputs under clause 8.7
- Apply clause 10.2 when cause elimination and recurrence prevention are actually needed
- Address risks and opportunities under clause 6.1
- Keep evidence that actions were implemented and that they worked
Choose a process that's proportionate to your risk, consistently applied, understandable to the people running it, and capable of producing real evidence. Building paperwork purely to satisfy terminology helps nobody, least of all the team standing in front of an auditor.
Frequently Asked Questions
What does clause 8.7 of ISO 9001:2015 require organizations to do?
Organizations must identify and control nonconforming outputs, determine an appropriate disposition, and retain applicable documented information. This is distinct from the broader cause-elimination work required under clause 10.2.
What is CAPA in ISO 9001?
CAPA stands for corrective and preventive action. It's a common operational framework connecting nonconformity control, root-cause analysis, risk treatment, and effectiveness review, not a separately named ISO 9001:2015 clause.
Does ISO 9001:2015 require a preventive action procedure?
No. The standard doesn't require a standalone preventive-action procedure. That intent is now addressed through risk-based thinking, operational controls, and continual improvement across the QMS.
Does ISO 9001:2015 require a CAPA form or CAPA software?
No specific form, software platform, or workflow name is prescribed. Organizations need documented information and objective evidence demonstrating conformity, in whatever format works for them.
What is the difference between correction and corrective action?
Correction addresses the immediate nonconformity, such as segregating an out-of-tolerance part. Corrective action addresses the cause behind it, so the same defect doesn't return on the next production run.