Non-conformities are resolved through short and long term corrective actions that ensure the issue is corrected and will not happen again. As far as relevant, the correction should address the non- conformity across the breadth of the organisation’s system, and not only the particular details described as evidence.
Corrective actions may be straightforward corrections of a mistake in the system, or require significant changes in the organisation’s management systems.
At the end of the period attributed to correct a non-conformity, the organisation has to demonstrate it has taken the necessary steps to correct the situation and minimise the risk of its recurrence.
In some cases, action has demonstrably been taken, but its effects may take longer to show. In such a case it is a judgement call of the auditor to determine whether the CAR can be closed or not i.e the risk of the non-conformity recurring is cancelled or significantly reduced.
The best practice to take appropriate corrective actions is to look for the root cause of the non-con- formity and to make sure that its primary cause has been addressed.
To resolve its non-conformities an organisation will need to work out a documented process for how it will deal with them and establish the steps that will be taken to:
- Review the problem and determine the cause(s) of the non-conformity (a cause analysis exer- cise can be very useful)– Ask: Who? What? When? How? Where? WHY? until arriving at the root cause of the problem;
- Propose an appropriate solution that will prevent the problem happening again, addressing the root cause(s) of the non-conformity;
- Decide on how the organisation will keep track and assess whether the actions taken were successful in preventing recurrence.
The organisation will need to keep track of the decision making and actions that were actually taken; records of the corrective actions provide evidence that the problem was recognised, corrected, and proper controls installed to make sure that it does not happen again. The organisation should also record any changes in the documented procedures resulting from corrective actions.
Corrective actions should be completed within the timeframe given by the auditor. Implementation / completion of the corrective actions will be reviewed, at the latest, at the next on-site audit and can be closed by an auditor if s/he is satisfied the problem is not recurring.
A Major non-conformity is automatically raised in the event of non-completion of the corrective actions in the given timeframes.