CAPA: Corrective and Preventive Action in ISO 9001
What corrective and preventive action (CAPA) means, how correction differs from corrective action, and what ISO 9001 clause 10.2 requires, step by step.
Corrective and preventive action (CAPA) is how a quality management system deals with problems. Corrective action removes the cause of a nonconformity that has already happened, so it does not recur. Preventive action removes the cause of a problem that could happen. Under ISO 9001:2015, corrective action has its own requirement in clause 10.2, while preventive action is built into risk-based thinking. This guide explains the difference between correction, corrective action and preventive action, sets out what clause 10.2 asks for, and walks through a CAPA process you can use before your next ISO 9001 certification audit.
What does CAPA mean?
CAPA stands for corrective and preventive action. The two terms come from ISO 9000, the vocabulary standard for ISO 9001. ISO 9000:2015 defined corrective action as "action to eliminate the cause of a nonconformity and to prevent recurrence" (clause 3.12.2). It defined preventive action as "action to eliminate the cause of a potential nonconformity or other potential undesirable situation" (clause 3.12.1) (ANAB).
Both definitions centre on the cause. CAPA is not about tidying up the result; it is about changing whatever produced it. ISO withdrew ISO 9000:2015 on 27 May 2026 and replaced it with ISO 9000:2026, as the ISO 9000:2015 record shows. If your system has moved to the 2026 editions, check the current wording.
CAPA sits inside the wider improvement work of a quality system. Our guide to quality assurance vs quality control explains why detecting a defect (quality control) is not the same as stopping it recurring (quality assurance).
Correction vs corrective action vs preventive action
The three terms are often mixed up, and the difference matters at audit. A correction acts on the output, a corrective action acts on the cause of a real problem, and a preventive action acts on the cause of a potential one.
| Aspect | Correction | Corrective action | Preventive action |
|---|---|---|---|
| Acts on | The nonconforming output | The cause of an actual nonconformity | The cause of a potential nonconformity |
| Timing | Immediately, when the problem is found | Usually after correction, once the cause is known | Before any problem occurs |
| Goal | Contain and fix this instance | Stop it happening again | Stop it happening at all |
| Example | Replace a wrongly dispatched item for the customer | Change the picking process that allowed the error | Add a barcode check on a new product line before launch |
| Typical evidence | Nonconformity record, rework or replacement note | Cause analysis, action plan, effectiveness check | Risk assessment, change plan, monitoring data |
A correction on its own is not wrong. It is often the right first response. The problem comes when the record ends there, and the same issue appears again a month later.
What people often call "immediate corrective action" is, in ISO terms, usually a correction. ISO 9000:2015 defined correction as "action to eliminate a detected nonconformity" (clause 3.12.3). Corrective action usually follows once the cause is known, although ISO 9000 notes that a correction can be made before, together with or after a corrective action.
Is preventive action still required in ISO 9001?
Not as a separate clause. Earlier editions of ISO 9001 had a dedicated preventive action requirement. ISO 9001:2015 removed it and spread prevention across the standard through risk-based thinking. The ISO technical committee responsible for the standard puts it plainly: "Preventive action is built-in when a management system is risk-based" (ISO/TC 176/SC 2 N1284).
In practice, the preventive side of CAPA shows up in three places:
- Planning. Clause 6.1 requires you to determine risks and opportunities and plan actions to address them.
- Operation. Controlled conditions in clause 8.5.1 include actions to prevent human error.
- Improvement. Clause 10.2 asks you to check whether similar nonconformities exist or could occur, and to update risks and opportunities after a problem.
Some sector standards keep the older structure. ISO 13485:2016 for medical devices, for example, still has separate corrective action and preventive action clauses, which is one reason the CAPA label is so common in that sector. If you work in medical devices, our ISO 13485 certification page sets out how certification works. Automotive suppliers work to IATF 16949, which adds its own problem-solving requirements to clause 10.2.
What ISO 9001 clause 10.2 requires
Clause 10.2 of ISO 9001:2015 covers nonconformity and corrective action. When a nonconformity occurs, including one arising from a complaint, the organisation must:
- React to it: take action to control and correct it, and deal with the consequences.
- Evaluate the need for action to eliminate its cause, so it does not recur or occur elsewhere. This involves reviewing and analysing the nonconformity, determining its causes, and determining whether similar nonconformities exist or could potentially occur.
- Implement any action needed.
- Review the effectiveness of any corrective action taken.
- Update risks and opportunities determined during planning, if necessary.
- Make changes to the quality management system, if necessary.
Corrective actions must be appropriate to the effects of the nonconformities encountered. Clause 10.2.2 then requires documented information as evidence of the nature of the nonconformity, the actions taken and the results of any corrective action.
In other words, ISO 9001 does not expect a full investigation for every typing error, and it does not accept a quick fix for a problem that could reach a customer or create a safety risk. Clause numbers here follow ISO 9001:2015. ISO 9001:2026 was published on 16 September 2026 (ISO), and our ISO 9001:2026 transition guide covers what changes for certified organisations. Advisera's comparison of the 2015 and 2026 editions classes clause 10.2 among the small, editorial changes, while actions on risks and on opportunities are split into separate sub-clauses of 6.1 (6.1.2 and 6.1.3). Clause 6.1 is where much of the preventive side of CAPA sits. Check the wording against your own copy of the 2026 standard.
The CAPA process step by step
A practical CAPA process follows the order of clause 10.2. The seven steps below are a common way of organising it; the standard itself does not number them. The table maps each step to the clause and to the evidence that shows the requirement is met.
| Step | What to do | ISO 9001:2015 clause | Evidence to keep |
|---|---|---|---|
| 1. Record and contain | Log the nonconformity, stop it spreading and correct the immediate problem | 10.2.1 a), 8.7 | Nonconformity record, containment and correction notes |
| 2. Decide the response | Judge the effect and risk, and decide whether cause analysis is needed | 10.2.1 b) | Rationale for the level of response |
| 3. Find the cause | Analyse why it happened, for example with the 5 Whys or a fishbone diagram | 10.2.1 b) | Cause analysis with evidence, not opinion |
| 4. Look wider | Check whether the same cause could affect other products, sites or processes | 10.2.1 b) | Notes on where else was checked and what was found |
| 5. Act | Change the process, instruction, training, equipment or supplier control | 10.2.1 c) | Action plan with owners and dates |
| 6. Check it worked | After a suitable period, confirm the problem has not recurred | 10.2.1 d) | Effectiveness review with data |
| 7. Update the system | Update risks, documents and objectives where needed, and report to management review | 10.2.1 e), f), 9.3 | Updated risk register, revised documents, review minutes |
Clause 10.2.1 d) explicitly requires you to review effectiveness. "Training given" is an action, not proof that the action worked. Effectiveness is shown by data: fewer repeats, cleaner inspection results or a stable complaint rate over a defined period.
Illustrative example: a dispatch error
Illustrative scenario. The example below was written for this guide. It is not a UniCert client case.
A small distribution business receives two customer complaints in a month about wrong items being dispatched. Here is how a weak response and a complete CAPA response differ.
| Step | Weak response | Complete CAPA response |
|---|---|---|
| Correction | Correct items sent to both customers | Correct items sent; stock locations checked for other mixed items |
| Cause | Recorded as "picker error" | Two similar products sit in adjacent bins with near-identical labels |
| Wider check | None | The same label layout is found on three other product pairs |
| Action | Picker reminded to take care | Bins re-labelled with colour coding; scan-to-pick check added for look-alike items |
| Effectiveness | Not checked | Dispatch error log reviewed after three months for repeat errors |
| System update | None | Look-alike products added to the risk register and the picking procedure updated |
The weak response blames a person and changes nothing. The complete response finds a cause in the process, looks for the same weakness elsewhere and proves that the fix worked.
Common CAPA weaknesses to avoid
Each of these weaknesses leaves a gap against a requirement in clause 10.2:
- Closing with a correction only. The record shows rework or replacement but no cause analysis (clause 10.2.1, item b).
- "Human error" as the root cause. It rarely explains why the process allowed the error, so the action cannot address it (clause 10.2.1, item b).
- No check for similar problems. The same cause may affect other products or sites (clause 10.2.1, item b).
- Effectiveness never reviewed. Actions are closed on the date they are completed, not when they are shown to work (clause 10.2.1, item d).
- No link to risks. The risk register is never updated after a significant nonconformity (clause 10.2.1, item e).
Our guide to common ISO 9001 nonconformities shows how weaknesses like these are graded, and can you fail an ISO audit? explains what happens when a major nonconformity is raised.
How CAPA connects to audits and certification
CAPA connects to every stage of the audit cycle:
- Internal audits produce findings that feed the CAPA process. Our ISO 9001 internal audit checklist shows the questions to ask, and ISO 9001 internal auditor training builds the skills to run them.
- Certification audits close with any nonconformities raised, and the certification body requires the organisation to analyse the cause and set out the correction and corrective action taken or planned, within a defined time (ISO/IEC 17021-1, clause 9.4.9). Our guides on how to prepare for an ISO 9001 audit and how to get ISO 9001 certified in the UK cover the full route.
- Surveillance audits include a review of actions taken on nonconformities from the previous audit (ISO/IEC 17021-1, clause 9.6.2.2), so open or ineffective actions resurface. See what happens after ISO certification.
- Integrated systems can run one CAPA process across quality, environment and health and safety, as explained in our guide to integrated management systems.
Who should own corrective action?
The person closest to the process usually leads the cause analysis, because they understand how the work is really done. Ownership of the action itself sits with whoever can change the process, for example a production manager, operations lead or supplier manager. Top management stays accountable for the effectiveness of the quality system (clause 5.1.1, item a) and reviews the results of corrective actions at management review (clause 9.3). A quality manager often coordinates the process, but cause analysis and action need the people who run the process, not the quality manager alone.
Making CAPA work in practice
Corrective and preventive action turns problems into improvements. Correct the immediate issue, judge how much response it deserves, find and remove the cause, check for the same weakness elsewhere and prove the fix worked. Prevention, meanwhile, lives in your risk planning rather than in a separate procedure.
To see how your current system compares with ISO 9001, an online ISO gap analysis offers a structured self-assessment; it is not consultancy. If you are planning certification, talk to our team about the audit route.
The same CAPA process applies whether you make products or deliver services. For sector detail, see ISO 9001 for manufacturing and ISO 9001 for service businesses.
About this guide
- Written by: Ersin Çetin, UniCert Certification. Ersin writes UniCert's guides to ISO management system standards and certification.
- Editorial process: This article was prepared with AI assistance and draws on the ISO standards and publicly available references listed below.
- ISO 9001 clause numbers refer to ISO 9001:2015 unless stated otherwise. The dispatch error example is an illustrative scenario, not a client case.
Sources
- ANAB (ANSI National Accreditation Board). Corrective Action vs. Preventive Action. Quotes ISO 9000:2015 clauses 3.12.1 and 3.12.2.
- International Organization for Standardization (ISO). ISO 9000:2015, Quality management systems: Fundamentals and vocabulary. Withdrawn on 27 May 2026 and replaced by ISO 9000:2026.
- ISO/TC 176/SC 2. Risk-based thinking in ISO 9001:2015 (document N1284), copy hosted by the International Aerospace Quality Group (downloads as a .docx file).
- International Organization for Standardization (ISO). ISO launches update to world's most widely used quality management standard. 16 September 2026.
- Advisera. ISO 9001:2015 vs. ISO 9001:2026: Main differences. Retrieved 14 October 2026.
- ISO 9001:2015, Quality management systems: Requirements. Clauses 5.1.1, 6.1, 8.5.1, 8.7, 9.3, 10.2.1 and 10.2.2 (paraphrased, not quoted).
- ISO 9000:2015, clause 3.12.3 (correction).
- ISO/IEC 17021-1:2015, Conformity assessment: Requirements for bodies providing audit and certification of management systems. Clauses 9.4.9 and 9.6.2.2 (paraphrased).
- ISO 13485:2016, Medical devices: Quality management systems. Separate corrective and preventive action clauses (paraphrased).
Related certifications:
Take the Next Step with UniCert
From ISO 9001 quality management to cyber security and supply chain assurance – UniCert provides the management system certification you need to unlock global markets.