ISO 13485 nonconforming product, corrective and preventive action

ISO 13485:2016 8.3 asks you to identify and control nonconforming product so nobody uses or ships it by mistake, including product found after delivery (8.3.3) and rework (8.3.4). Clause 8.5 asks you to keep the system effective (8.5.1) and to run documented corrective action (8.5.2) and preventive action (8.5.3), each checked so it does not harm device safety or compliance.

The requirement in plain English

Control of nonconforming product (ISO 13485:2016 8.3.1). A documented procedure says who finds, records, segregates and evaluates product that does not meet requirements, and who decides what happens to it. The evaluation includes whether to investigate and whether to tell the outside party responsible, such as the supplier. Records keep the nonconformity, the evaluation, any investigation and the reason for each decision.

Found before delivery (ISO 13485:2016 8.3.2). You remove the nonconformity, stop the product being used as intended, or accept it under a concession. A concession needs a justification, an approval and confirmation that regulatory requirements are still met, and the record names who authorised it.

Found after delivery (ISO 13485:2016 8.3.3). You act in proportion to the actual or potential effects. A documented procedure for issuing advisory notices, written to the regulatory requirements you are under, must be ready to use at any time, and its use is recorded.

Rework (ISO 13485:2016 8.3.4). Rework follows a documented instruction that considers any harm the rework could do, approved in the same way as the original procedure. Reworked product is verified again against its acceptance criteria.

Improvement (ISO 13485:2016 8.5.1). You change whatever keeps the system suitable, adequate and effective and keeps devices safe and performing, drawing on the quality policy and objectives, audits, post-market surveillance, data analysis, corrective and preventive actions and management review. ISO 13485 asks you to maintain effectiveness rather than to improve continually.

Corrective action (ISO 13485:2016 8.5.2). A documented procedure covers reviewing nonconformities, complaints included; finding their causes; deciding whether action is needed so they do not recur; planning, documenting and carrying it out, documents included; checking the action does not harm regulatory compliance or the device’s safety and performance; and reviewing whether it worked. Act without undue delay, in proportion to the effects.

Preventive action (ISO 13485:2016 8.5.3). The same steps, aimed at potential nonconformities: find their causes, decide, act in proportion, check for harm, review effectiveness and keep records. Its inputs are usually the trends you analyse under ISO 13485:2016 8.4.

A correction fixes the instance: you quarantine the lot. A corrective action removes the cause: you change the calibration interval that let the sealer drift. A preventive action removes the cause of a problem that has not happened yet: you apply that interval to the second sealer before it drifts.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 25-person company makes a Class IIa wound-monitoring patch and its app. Every out-of-specification lot, failed incoming inspection and software release defect gets a nonconformity record. A review board of the quality lead and the engineering lead meets weekly to decide each disposition: scrap, rework, return to supplier or concession. Concessions are rare, carry a written justification and need the regulatory lead’s signature as well as the quality lead’s.

The CAPA procedure has written triggers: any complaint involving injury, any major audit finding, and the same nonconformity three times in a quarter. Below the triggers, a nonconformity record with a correction is enough, and the record says so. Each CAPA states the problem, the containment, the root cause with its evidence, the action, a regulatory and risk impact check, and an effectiveness test chosen when the action is planned.

Preventive actions come from the monthly data review: a supplier’s reject rate creeping up, a complaint category growing, a process parameter drifting towards its limit. They are logged as preventive and reviewed the same way.

Once a year the team runs a mock advisory notice. It traces one shipped lot to every customer within a set time, using its traceability records (ISO 13485:2016 7.5.9), and fixes whatever slowed it down. CAPA status and trends go to the management review, where they are required inputs (ISO 13485:2016 5.6.2).

Evidence an auditor expects

• Nonconforming product procedure and records (required): the auditor samples records for identification, segregation, the disposition and who decided it.
• Concession records (required where used): a justification, an approval, the regulatory check and the authoriser’s name.
• Rework instructions and re-verification (required where rework happens): the instruction’s approval matches the original procedure’s, and reworked units were tested again.
• Advisory notice procedure (required): the auditor checks it exists and could be used today; a recorded mock exercise is usual rather than required, and persuasive.
• CAPA procedures and records (required for both corrective and preventive action): causes with evidence, the no-harm check, implementation and an effectiveness review with results.
• Trend inputs to preventive action: the auditor asks which data analysis produced each preventive action.
• Management review minutes: corrective and preventive action status appears as an input.

Common mistakes

Every nonconformity becomes a CAPA

The log holds 200 open CAPAs, most of them single slips, and none close on time. Notified bodies read an overloaded system as an ineffective one. Write triggers based on risk, and let a nonconformity record with a reasoned decision handle the rest.

Preventive actions that are corrective actions in disguise

A team files the fix for last month’s complaint as preventive to show the clause is used. Auditors check that each preventive action targets something that has not happened. Feed preventive action from trends and from problems found in neighbouring products.

No regulatory impact check

A CAPA changes a supplier or a design and closes. Nobody asked whether the change is significant enough to tell the notified body, or whether the technical documentation and risk file need updating. Put the no-harm and regulatory impact question in every CAPA and make someone answer it.

An advisory notice procedure nobody has tried

The procedure exists, but traceability records cannot say which hospitals received lot 2417 without a week of spreadsheet work. Run a timed mock exercise and fix the gaps before you need it for real.

Use-as-is without a concession

Production accepts slightly out-of-tolerance parts because they “work fine”, with no justification or approval. That is a concession made informally, and the auditor will raise it. Route every acceptance of nonconforming product through the concession steps.

How Sted helps

Related guides and terms

• Root-cause analysis for a CAPA: finding and proving the cause, with a sterile pouch worked example.
• Measurement, analysis and feedback: the complaints, audits and data analysis that feed corrective and preventive action.
• Preventive action: the half of CAPA only ISO 13485 keeps as its own clause.
• Post-market surveillance and vigilance under EU MDR: when a problem found after delivery also has to be reported.
• Records in Sted: how a CAPA or nonconformity record is opened, completed and closed.
• ISO 13485 hub: how this clause fits the rest of the standard.

Frequently asked questions