Nonconformity vs Corrective Action: ISO 9001:2026 Clauses 8.7 and 10.2
Updated: 6 days ago
Most manufacturers handle problems in a familiar way: something goes wrong, someone fixes it, and sometimes a CAPA gets opened. ISO 9001:2026 asks for something more specific. Clause 8.7 covers what you do with the nonconforming product or service itself. Clause 10.2 covers what you do about the cause. Auditors look for both, and a common finding is a system that handles one well and skips the other.
ISO 9001:2026 was published on 16 September 2026. This post explains how the two clauses fit together, what changed in Clause 10, and how to set up procedures and records so the link between them is easy to show an auditor.
Two clauses, two different jobs
Clause 8.7, Control of nonconforming outputs, sits in the Operation section of the standard. It is about the output: the part, lot, assembly or service that does not meet requirements. Clause 10.2, Nonconformity and corrective action, sits in the Improvement section. It is about the problem behind the output and whether it could happen again.
A simple way to keep them apart:
Correction (8.7): action taken on the nonconforming output itself, such as rework, scrap, sorting or holding a lot.
Corrective action (10.2): action taken to eliminate the cause of a nonconformity so it does not recur.
A correction can close out a single event. On its own, it does not show that the cause was found or addressed.
What Clause 8.7 expects
Clause 8.7 requires you to identify and control outputs that do not conform to requirements so they are not used or delivered by mistake. The standard lists the ways you can deal with them:
Correction
Segregation, containment, return or suspension of provision of products and services
Informing the customer
Obtaining authorization for acceptance under concession
Clause 8.7.2 calls for retained documented information that describes the nonconformity, the actions taken, any concessions obtained, and who decided the action. ISO 9001:2026, like the 2015 edition, does not require a documented procedure for this. Most manufacturers keep one anyway, because disposition decisions involve several departments and need to be made the same way every time.
In practice, Clause 8.7 is your nonconforming material report, your hold tags and quarantine area, and your material review decisions.
What Clause 10.2 expects
Clause 10.2 applies to any nonconformity, not only product. That includes process failures, skipped procedure steps, supplier problems and internal audit findings. When a nonconformity occurs, the organization is expected to:
React to it and, as applicable, control and correct it and deal with the consequences
Evaluate the need for action to eliminate the cause, by reviewing the nonconformity, determining its causes, and determining whether similar nonconformities exist or could occur
Implement any action needed
Review the effectiveness of any corrective action taken
Update risks and opportunities and make changes to the QMS, if necessary
Retained documented information must show the nature of the nonconformity, the actions taken, and the results of any corrective action.
The phrase "evaluate the need for action" matters. Not every nonconformity needs a full investigation. A documented, risk-based decision that a one-off event does not need corrective action is acceptable, as long as you can show how the decision was made and who made it.
What changed in Clause 10
Clause 10 is shorter in the 2026 edition. ISO 9001:2015 had three subclauses: 10.1 General, 10.2 Nonconformity and corrective action, and 10.3 Continual improvement. ISO 9001:2026 merges the general and continual improvement content into 10.1 Continual improvement and keeps 10.2 Nonconformity and corrective action.
The second change concerns complaints. The 2015 text referred to nonconformities "including any arising from complaints." In ISO 9001:2026, that reference has moved to a note, on the reasoning that not every complaint is a nonconformity. Complaints still need to be handled. A complaint about lead time, for example, may lead to a review without being a nonconformity against a requirement. The change gives you room to evaluate complaints first instead of opening a corrective action for each one.
If your procedures cite clause numbers, update any references to 10.3. Then check that your complaint procedure explains how a complaint is evaluated before it becomes a nonconformity or a corrective action.
Common audit findings
Corrections recorded as corrective actions. A CAPA closed with "parts reworked" or "operator retrained" and no cause analysis.
No link between the NCR and the CAPA. The nonconforming material report and the CAPA record do not reference each other, so the auditor cannot follow the trail.
No recorded decision. Repeat nonconformities with no record of whether corrective action was considered.
Effectiveness checks that only confirm completion. "Action implemented" is not evidence that the cause was eliminated. Define the check, the time frame and the data before you close the record.
Similar nonconformities not checked. The fix was applied to one line or product when the same cause affects others.
Risks and the QMS not updated. The cause pointed to a gap in a procedure, risk assessment or training, and nothing was revised.
How to structure the procedures
Most manufacturers use a small set of separate, linked procedures. Each one has a clear job, and the hand-offs between them are where auditors focus.
Nonconforming material
Covers identification, segregation, recording, disposition, concessions and customer notification. It should also state the criteria for escalating a nonconformity to corrective action, such as repeat occurrence, customer impact or safety concerns.
Failure investigation
Covers how you investigate a failure and find the cause, including the method used and how you check whether other products, lines or processes are affected.
Corrective and preventive action
Covers initiation, investigation, risk assessment, implementation, effectiveness verification, escalation and closure. ISO 9001 has no separate preventive action clause. Preventive thinking is handled through risks and opportunities in Clause 6.1, which many companies still manage within one CAPA system.
Complaint handling
Covers receipt, review, investigation and customer response, and the decision on whether a complaint is a nonconformity that needs corrective action. With the 2026 change to Clause 10.2, this decision step deserves a clear description.
Whatever the structure, make the connections visible: escalation criteria from the NCR to the CAPA, record numbers that cross-reference, and a named owner for the effectiveness review.
Documents that cover these clauses
A.P. Lyon's ISO 9001:2026 procedures are editable Word documents that work on paper or in an eQMS. They were written by founder Aaron Lyon, who has more than 30 years in product design, development and global manufacturing and is a former Senior Director of Regulatory Affairs.
Browse the full ISO 9001 QMS category, or combine procedures with Build Your QMS for 20% off 5–9 procedures, 35% off 10–19, 50% off 20–39 and 60% off 40 or more. If you want help adapting these procedures to your processes or preparing for a transition audit, see A.P. Lyon consulting.
Comments