ISO 9001 improvement

ISO 9001:2015 clause 10 asks you to pick and act on improvements (10.1), to handle every nonconformity the same way (10.2): correct it, find and remove its cause, check the fix worked, and update your risks where needed, and to keep improving the system as a whole (10.3). Its numbering differs from ISO 27001:2022.

The requirement in plain English

General (ISO 9001:2015 10.1). You look for opportunities to improve and act on the ones you choose, so you meet customer requirements and raise satisfaction. Improvement means better products and services, fewer unwanted effects, and a better-performing system. A note to the clause makes clear that improvement ranges from a single fix to a step change in how you work.

Nonconformity and corrective action (ISO 9001:2015 10.2). When a nonconformity occurs, including one raised by a complaint, you (10.2.1):

1. contain and fix it, and deal with what it has already caused;
2. decide whether its cause needs removing so it does not happen again or elsewhere, which means working out what happened, why, and whether the same problem exists or could occur in other places;
3. carry out whatever that calls for and later check that it worked;
4. update the risks and opportunities from your planning if the problem shows they were wrong (ISO 9001:2015 6.1);
5. change the quality management system itself where the fix needs it.

Size the action to the effects. You keep documented information on what went wrong, what you did and what the corrective action achieved (10.2.2).

Continual improvement (ISO 9001:2015 10.3). You keep making the system more suitable, adequate and effective, using the results of your analysis (ISO 9001:2015 9.1.3) and of management review (ISO 9001:2015 9.3) to decide where.

A correction fixes the instance: you replace the wrong part. A corrective action removes the cause: you change how parts are picked. A nonconforming product caught before it leaves is first handled under ISO 9001:2015 8.7, covered on the operation page; clause 10.2 decides whether its cause needs action.

ISO 27001:2022 puts continual improvement first, at 10.1, and nonconformity second; ISO 9001:2015 has three clauses with improvement split either side. The 2026 edition is reported to fold 10.3 into 10.1 with the same substance, so check the numbering in your copy before you renumber procedures.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 35-person company that installs and services commercial kitchen equipment keeps one corrective action log for every source: customer complaints, internal audit findings, certification audit findings, nonconforming jobs and missed objectives. Each entry records the problem, the immediate correction, the root cause with the evidence for it, the corrective action with an owner and a date, and a planned effectiveness check.

One entry: three repeat visits in a month because engineers fitted the wrong spare part. The correction fits the right parts. The cause is that the parts list is looked up by model name, and two models share a name across production years. The corrective action makes the job system look parts up by serial number. The effectiveness check samples 30 jobs in the next quarter: no wrong parts, and repeat visits back under 2%. The risk register gains the risk of supplier part changes, and the procedure is updated.

Improvement shows beyond fixes. The log also holds engineers’ suggestions and the decisions from management review, and the quality manager reports twice a year on which changes came from where.

Evidence an auditor expects

• Record of each nonconformity and the action taken (required documented information, 10.2.2): the auditor checks the description, the correction and the dates.
• Results of corrective action (required): an effectiveness check with evidence, not a closure date alone.
• Root cause analysis: usual rather than prescribed in form; the auditor checks the cause is plausible and supported.
• The look for similar problems: the auditor asks where else you checked.
• Updated risks and procedures: the auditor traces a corrective action to the risk register or the procedure it changed.
• Improvement evidence: changes over the year traced to their trigger, from analysis, review or staff.

Common mistakes

Closing on the correction

The part is replaced and the record closes. The cause stays, and the auditor finds the same problem at the next surveillance audit, now graded higher. Close only after the corrective action and its effectiveness check.

Complaints kept apart from corrective action

Complaints live in a customer service tool and never reach the corrective action log. Clause 10.2 names complaints as a source. Review each complaint for a missed requirement and raise a record where there is one.

Risks never updated

A nonconformity reveals a risk nobody had considered, and the risk register stays the same. Clause 10.2.1 asks you to update risks and opportunities where needed. Make it a closing question on every record.

“Retrain the operator”

Retraining is the most common corrective action and the least effective when the process invites the error. Ask why the error was possible and change the process.

Improvement that is only fixes

If every change in a year came from an audit finding, the system is not improving itself. Record improvements from data, customers and staff too.

How Sted helps

Related guides and terms

• Root-cause analysis for a CAPA: finding the cause and proving the fix worked.
• Performance evaluation: the audits, analysis and review that feed improvement.
• Corrective and preventive action (CAPA): the record most organisations use for clause 10.2.
• Records in Sted: how a corrective action record is opened, completed and closed.
• ISO 9001: how clause 10 closes the loop back to planning.

Frequently asked questions