Clause 10.1: Nonconformity and corrective action
When a nonconformity occurs the organization has to react to it, decide whether action is needed to remove the cause so it does not recur, implement that action, review whether it worked, update the risks and opportunities from 6.1 where needed and make any necessary change to the records system.
What clause 10.1 asks
When a nonconformity occurs the organization has to react to it, decide whether action is needed to remove the cause so it does not recur, implement that action, review whether it worked, update the risks and opportunities from 6.1 where needed and make any necessary change to the records system. It also has to keep documented information of the nonconformity, the action taken and the result. The clause assumes nonconformities are found through monitoring, audit, review or other means rather than requiring a separate identification process.
A corrective action removes the cause so the problem does not recur. Closing every issue as human error is a signal that the cause analysis is not being done.
Reading it in practice
A corrective action that ends with retraining is usually a sign that the cause was not found. Ask what allowed the error to happen: a missing field, an unclear rule, a system default, an unowned handover. Fix that, then check whether the same cause exists elsewhere. The clause asks for the review of effectiveness, not just the action.
The third edition is at stage 50.00 and its clause text is not public. No public draft wording. The 2019 text assumes nonconformities are found through monitoring, audit or review and focuses on the reaction, the cause, the action and the review of its effect.
Status: not shown in the public record. The 2019 requirement above is the one a certificate is issued against. No draft requirement is asserted.
Evidence for clause 10.1
Expect a nonconformity log with what happened, the cause, the action, the review of its effect and any change to the risk picture.
- Nonconformity Nonconformity log with the record of what happened, the cause and the action
- Nonconformity Evidence the corrective action was implemented and its effect reviewed
- Nonconformity Updated risk assessment where the cause changed the risk picture
Where clause 10.1 commonly fails
- Every issue closed as human error with no cause analysis
- A corrective action that fixes the symptom in one system and leaves the same cause in another
What to do about clause 10.1 before the revision
Take one recent issue and redo the cause analysis. Ask whether the same cause exists in another system or site. Record the action and check it after 30 days.
Read across from clause 10.1
Open the full index. The revision record shows the public stage record and the proven 2011 to 2019 changes.
Source for clause 10.1: ISO 30301:2019, ISO 30301:2019, Clause 10.1, retrieved 22 October 2026. The requirement, evidence and gaps are written from our clause record; the draft status rests on the ISO/PRF 30301 page 89772. Every source.