Chapter 1: The Audit Finding That Keeps Coming Back

Let's start with the evidence. According to audit data from Canada's accredited certification bodies, Clause 10.2 (Nonconformity and corrective action) generates more major findings than any other clause in ISO 9001. That includes process control, documented information, and management review. It's the audit failure point that appears in surveillance audits, recertification audits, and second-opinion audits across automotive, aerospace, medical device, and general manufacturing sectors.

Why? Because auditors aren't just checking for the existence of a corrective action form. They're tracing the entire cycle—from the moment a nonconformance is identified, through root cause analysis, into implementation and follow-up, and finally into an objective verification that the problem actually stopped happening.

Here's what the audit typically looks like in practice:

The auditor walks the floor and spots a nonconformance. A customer shipment had a dimensional defect. Your system logged it. Good. But then the auditor asks: "Show me the corrective action." You hand over a one-page form. It says "retrain operator" and "date closed."

The auditor then asks: "How do you know the retraining worked? Do you have evidence that the same defect hasn't occurred since? What was the real root cause—why did the operator make that mistake in the first place? Was it training alone, or something else?"

And here's where most Canadian manufacturers stumble: they can't answer those questions with data.

The corrective action process isn't just a form to complete. It's a closed-loop system:

1. Identification
2. Investigation
3. Root Cause Analysis
4. Corrective Action Definition
5. Implementation
6. Effectiveness Verification
7. Closure

Break any link in that chain, and the auditor flags it as a major nonconformance.

Common Gaps Across Canadian Plants

• Weak root cause analysis. Forms list symptoms, not causes. "Equipment malfunction" instead of "bearing wear from inadequate lubrication interval."
• No effectiveness criteria. CAs are closed based on a date, not on measurable proof that the problem stopped.
• Missing timeline discipline. CAs drift open for months. No clear owner. No urgency.
• One-and-done thinking. A single corrective action is written for a systemic issue affecting multiple processes or suppliers.
• No evidence trail. The auditor asks for records of the corrective action implementation and can't find them—or finds them scattered across email, spreadsheets, and paper notes.

Important: When an auditor finds these gaps, they document a major nonconformance under Clause 10.2. Major findings put your certification at risk. Miss the deadline to respond, and your certification can be suspended.