Most rejected corrective actions are rejected for the same reason: the business fixed the instance and called it done. The assessor wanted to know why it happened.
A non-conformance response has four parts, and leaving any of them out is what sends it back.
The four parts
1. Correction. What you did about the specific thing found. The immediate fix. If a calibration certificate was out of date, the correction is getting the instrument calibrated.
2. Root cause. Why it happened. Not what happened again in different words. This is where most responses fail.
3. Corrective action. What you changed so it does not recur. This has to follow logically from the root cause. If your root cause is "no reminder system", your corrective action is a reminder system.
4. Objective evidence. Proof that both the correction and the corrective action happened. Documents, records, screenshots, dated.
Root cause is where responses fail
Compare these two:
Weak: "The calibration certificate for gauge 14 had expired. Root cause: the gauge was not calibrated on time."
That is a restatement, not a cause. It says the thing that happened, happened.
Better: "Root cause: calibration due dates were tracked on a spreadsheet maintained by one person, with no automated reminder and no cover when that person was absent. Gauge 14 fell due during a two-week absence and nobody was monitoring the schedule."
The second explains why the system allowed it. It also points straight at a corrective action that would actually work, which the first does not.
The simplest way to get there is to keep asking why until the answer becomes a system rather than a person. If your root cause is "operator error" or "human error", you have almost certainly stopped too early. People make mistakes constantly. A management system is meant to catch them. The real question is why it did not.
A worked example
Finding: Two of six staff sampled had no record of induction training.
Correction: Both staff completed induction on 14 March, records filed.
Root cause: Induction was triggered by the line manager rather than by HR onboarding. Both individuals joined through an agency rather than direct recruitment, and the agency route had no induction step, so nobody owned it.
Corrective action: Agency placements added to the HR onboarding checklist with induction as a mandatory item before site access is granted. Checklist updated 18 March. All current agency staff audited for induction records, one further gap found and closed.
Evidence: Updated onboarding checklist, induction records for both individuals, audit record of the wider check, and the record of the third gap being closed.
Note what that last part does. Checking whether the same problem exists elsewhere, and saying so, is what turns a response from adequate to convincing. Assessors call this extent of the problem, and volunteering it saves a round trip.
Timescales
You will normally be given a deadline, often 30 days for a minor and something shorter for a major. Minor non-conformances are usually accepted on documentary evidence. Majors may require the assessor to verify on site before the certificate is issued or maintained.
If you cannot complete a corrective action within the window because it needs a system change, say so with a dated plan rather than sending a rushed response. A credible plan with milestones is generally accepted. Silence is not.
Do not over-correct
A common and expensive mistake is responding to a small finding with a large new procedure. You have now created a documented commitment that will be audited every year, generated to solve a problem that a single checklist line would have fixed. The corrective action should be proportionate to the root cause.
Use your own system first
The best position to be in is one where your internal audits find these things before an assessor does. A business raising and closing its own non-conformances is demonstrating exactly what the standard is asking for, and assessors read a healthy internal findings log as a good sign rather than a bad one.
If your internal audit programme is not finding anything, it is not working. Ongoing system support covers running audits that find real issues, and internal auditor training gets your own team to the point where they can do it. If you have an audit coming up, our guide to preparing for a certification audit covers what to have ready.
‹ Back to all articles