Quick answer: ISO 9001 separates two related but distinct obligations. Clause 8.7 governs nonconforming outputs discovered during operations—correcting the immediate problem. Clause 10.2 governs corrective action against the systemic cause of a nonconformity, while clause 10.3 requires organizations to continually improve their quality management system's (QMS) suitability, adequacy, and effectiveness over time.
Organizations pursuing ISO 9001 certification often conflate "fixing a defective product" with "fixing the system that allowed the defect." These are not the same obligation, and the standard treats them differently on purpose. Understanding where each requirement applies—and where the two intersect—determines whether your quality management system produces genuine learning or simply generates paperwork.
This distinction matters more than it might first appear. Organizations that treat every nonconforming output and every systemic nonconformity identically tend to create unnecessary bureaucracy, where employees spend their time completing records instead of actually learning from what went wrong. Getting the scope right protects both compliance and efficiency.
Clause 8.7, Control of Nonconforming Outputs, sits within the operation stage of ISO 9001:2015. It applies when a specific product, service, or output fails to meet requirements, and it's focused on containing that immediate problem rather than diagnosing why it happened.
Under clause 8.7, the organization must:
Clause 8.7 is deliberately narrow (QMS Certification, Nov 10, 2021). It answers the question "what do we do with this specific defective output right now?" It does not require the organization to investigate root cause or prevent recurrence—that responsibility belongs elsewhere in the standard.
Clause 10.2, Nonconformity and Corrective Action, sits in the Improvement stage of ISO 9001:2015 and covers the entire management system—not just a single defective output. Its scope is broader than clause 8.7 and explicitly includes nonconformities arising from customer complaints (QMS Certification, Nov 10, 2021).
When a nonconformity occurs, clause 10.2 requires the organization to:
Choose a full clause 10.2 corrective action process if the nonconformity reflects a systemic weakness—a process gap, a training failure, a design flaw—that could recur across multiple outputs or locations. Choose a simple clause 8.7 correction if the issue is isolated to a single output and doesn't indicate a broader failure.
One detail trips up many organizations: ISO 9001 does not require corrective action for every nonconformity. The organization decides whether corrective action is warranted based on the significance of the nonconformity's effects within its own context (QMS Certification, Nov 10, 2021). A minor, one-off deviation with negligible consequences may only need correction under 8.7. A recurring pattern, or a nonconformity with serious downstream impact, warrants the full root-cause analysis of 10.2.
Clause 10.3 states that "the organization shall continually improve the suitability, adequacy and effectiveness of the quality management system" (NQA, ISO 9001 Back to Basics webinar). Unlike clauses 8.7 and 10.2, clause 10.3 isn't triggered by a specific nonconformity. It's an ongoing, proactive obligation that exists independent of whether anything has gone wrong.
In practice, organizations are expected to consider the outputs of their analysis, evaluation, and management review activities to determine whether there are needs or opportunities for improvement (Core Business Solutions). Commonly cited practical approaches—though these are implementation guidance rather than mandated standard text—include:
Continual improvement, corrective action, and nonconformity control work together as a system. Nonconforming outputs and systemic nonconformities feed data into the broader improvement process, while clause 10.3 ensures the QMS keeps evolving even when nothing specific has broken.
The current structure reflects a deliberate evolution. ISO 9001:1994 introduced preventive action as a distinct requirement. ISO 9001:2000 consolidated corrective action, preventive action, and continual improvement under a single clause 8.5, "Improvement." ISO 9001:2015 restructured the standard around risk-based thinking, replacing the standalone preventive action requirement and reorganizing improvement activity into clause 10, with 10.1 (General), 10.2 (Nonconformity and corrective action), and 10.3 (Continual improvement) (Core Business Solutions).
The logic behind this change: risk-based thinking, embedded throughout ISO 9001:2015, effectively makes prevention a continuous planning activity rather than a reactive response triggered after something goes wrong. Instead of a separate "preventive action" clause, organizations are expected to anticipate risks during planning and address them before they materialize as nonconformities.
ISO 9001:2026 was published on September 16, 2026, replacing ISO 9001:2015 and incorporating Amendment 1:2024 on climate change considerations within clauses 4.1 and 4.2 (ISO9001Help). Organizations certified to ISO 9001:2015 have a transition deadline of up to September 30, 2029 (CyberCrest Compliance).
According to QMS Certification (Oct 1, 2026), the 2026 revision is evolutionary rather than a wholesale restructuring like the 2015 edition. Notable developments include:
Organizations will also need to demonstrate more clearly that their QMS contributes to intended results and measurably improved performance—a theme that reinforces, rather than replaces, the existing corrective action and continual improvement framework.
The clause numbers referenced throughout this article (8.7, 10.2, 10.3) reflect the ISO 9001:2015 structure. Organizations transitioning to ISO 9001:2026 should confirm whether numbering or clause content has shifted by reviewing the official 2026 text directly, since specific wording changes to clause 10 have not been independently verified here.
The practical takeaway is this: match the response to the scope of the problem. A single defective batch needs correction and containment under clause 8.7. A recurring pattern or systemic weakness needs root-cause analysis and corrective action under clause 10.2. And regardless of whether anything has gone wrong, your organization still carries an ongoing obligation under clause 10.3 to keep improving the QMS itself.
Organizations that keep these three requirements distinct—rather than defaulting to the same heavyweight documentation process for every issue—tend to build quality systems that genuinely reduce recurring problems, instead of just accumulating records. As ISO 9001:2026 rolls out through 2029, revisiting how your organization distinguishes correction from corrective action from continual improvement is a useful starting point for transition planning.
A correction, addressed under clause 8.7, fixes a specific nonconforming output—for example, reworking a defective part. A corrective action, addressed under clause 10.2, goes further by identifying and eliminating the root cause so the nonconformity doesn't recur or appear elsewhere in the organization.
No. ISO 9001:2015 clause 10.2 does not mandate corrective action for every nonconformity. The organization determines whether action is needed based on the significance of the nonconformity's effects, using its own context and risk assessment to make that judgment (QMS Certification, 2021).
Organizations currently certified to ISO 9001:2015 have until September 30, 2029, to transition to ISO 9001:2026, according to CyberCrest Compliance.
No. Corrective action under clause 10.2 responds to a specific nonconformity. Continual improvement under clause 10.3 is an ongoing, system-wide obligation to improve the QMS's suitability, adequacy, and effectiveness, regardless of whether a nonconformity has occurred.
Preventive action, a standalone requirement in earlier versions of ISO 9001, was replaced in the 2015 edition by risk-based thinking, which is embedded throughout the standard rather than isolated in a single clause (Core Business Solutions).
Registration for this event has closed.
Error: The webinar is full. Please contact the webinar’s host if you feel this is a mistake.
Error: This email address is already registered for this event. Please contact the webinar host if you have any questions.
