Nonconformity & Corrective Action (CAPA)

Mandatory record – ISO 9001/27001 cl.10.2. The improvement engine: every NC needs root cause (not just a fix) + effectiveness check.

Field	Value
CAPA ID	NC-YYYY-NNN
Opened	YYYY-MM-DD
Source	Audit / incident / complaint / review
Detected by	@name
Owner	@name
Status	Open / Root cause / Implementing / Verify / Closed

1. Nonconformity description

What requirement was not met, where, when – factual, evidence-based.

• Requirement: clause / policy / spec violated
• What happened: observed condition
• Evidence: record/photo/log reference

2. Immediate correction (containment)

The quick fix to stop the bleeding – done first, does NOT close CAPA.

Action	By	Date
Containment step	@name

3. Root cause analysis

The most-failed step – auditors check that root cause ≠ symptom.

flowchart LR
    P[Problem] --> W1[Why 1] --> W2[Why 2] --> W3[Why 3] --> W4[Why 4] --> W5[Why 5: root cause]

• Method: 5 Whys / fishbone / fault tree
• Root cause: systemic reason, not "human error"

4. Corrective action

Address the ROOT cause so it cannot recur:

Action	Eliminates root cause?	Owner	Due	Done
Systemic fix	yes – how	@name

5. Effectiveness verification

• Check date: YYYY-MM-DD (≥ enough time to show recurrence stopped)
• Evidence: metric / re-audit / observation
• Result: effective – close / not effective – reopen at step 3

6. Closure

Signed	Role	Date
	Quality/ISMS manager

7. Linkages

• Feeds management review input (cl.9.3)
• Updates risk register if new risk surfaced
• Procedure change if root cause was process gap