Corrective action
A corrective action is action that removes the cause of a nonconformity so it does not happen again. It follows the immediate fix, rests on a root cause you can show evidence for, and is not finished until you have checked that it worked.
- Clauses
- ISO 27001:2022 10.2 · ISO 9001:2015 10.2 · ISO 13485:2016 8.5.2 · ISO 42001:2023 10.2
Where the term appears
ISO 27001:2022 10.2, ISO 9001:2015 10.2 and ISO 42001:2023 10.2 share one shape: react to the nonconformity, decide whether its cause needs removing so it does not recur or occur elsewhere, act, review whether the action was effective, and change the management system where needed. The action should be proportionate to the effects of the problem. ISO 13485:2016 8.5.2 asks for the same in a documented procedure and adds a device-specific check: the action must not harm regulatory compliance or the safety and performance of the device.
Correction or corrective action
This is the auditor’s first test. Removing the account a leaver still had is a correction. Changing the leaver process so HR’s exit date reaches IT on the day is the corrective action. A record closed on the first alone usually returns at the next audit as a repeat finding, often graded higher. The ISO 27001 improvement page covers clause 10 in full.
How Sted uses it
- Sted’s knowledge base includes a Corrective and Preventive Actions record template, under its Corrective and Preventive Action Procedure.
- Records are part of the Full Management System plan.
- Sted does not carry out root-cause analysis; it holds the record of yours.
Related terms
- Correction: often confused with corrective action; it fixes the instance, not the cause.
- Root cause: what a corrective action has to remove.
- Nonconformity: the trigger.
- Preventive action: the same idea aimed at a problem that has not happened yet.
- CAPA: the broader process both actions sit in.
- Root-cause analysis for a CAPA: how to find the cause before choosing the action.