ISO 9001 CAPA — Corrective Action Under Clause 10.2 (and Why “Preventive” Disappeared)
In ISO 9001:2015, corrective and preventive action were merged into a single Clause 10.2. The standalone “preventive action” clause from 2008 is gone — risk-based thinking (Clause 6.1) now covers prevention. This page explains what CAPA must demonstrate and the root-cause discipline auditors look for.
Clause 10.2 — what you must do
When a nonconformity occurs, Clause 10.2.1 requires you to react, contain its effects, evaluate the need for action to prevent recurrence, implement corrective action, review its effectiveness, and update risk and documented information as needed. Clause 10.2.2 requires records of the nature of the nonconformity, actions taken, and the results.
Where preventive action went
The 2008 Clause 8.5.3 “preventive action” was removed because the 2015 revision expects organizations to prevent problems proactively through risk-based thinking (Clause 6.1) and the planning of processes. Prevention is no longer a separate procedure — it is built into how you run the system.
What separates a good CAPA from a bad one
Auditors probe the root-cause step. “Operator error” or “more training” are rarely accepted as root causes. A strong CAPA shows a verified root cause, an action that addresses it, objective evidence the action worked, and a check that similar processes aren’t exposed to the same failure (Clause 10.2.1 d).
Frequently asked questions
Does ISO 9001:2015 require a separate preventive action procedure?
No. Preventive action was removed as a standalone requirement. Prevention is now expected through risk-based thinking in Clause 6.1 and throughout the planning clauses.
What records must CAPA keep?
Clause 10.2.2 requires documented information as evidence of: the nature of the nonconformities and any consequences; the actions taken; and the results of any corrective action, including its effectiveness review.
Can a minor nonconformity skip CAPA?
Every nonconformity must be addressed (Clause 10.2.1). The depth of analysis should match the risk, but the cycle — react, contain, root-cause, act, verify — applies to all.