To help organizations determine how to ensure compliance with ISO 9001:2015 we’ll start by defining the key words and their meanings (see ISO 9000:2015):
• Correction—action to eliminate a detected nonconformity.
• Corrective action—action to eliminate the cause of a nonconformity and to prevent its recurrence.
• Preventive action—action to eliminate the cause of a potential nonconformity or other potential undesirable situation.
• Nonconformity—nonfulfillment of a requirement.
• Risk—an effect of uncertainty. Note that there are six notes elaborating on this definition in ISO 9000, which include references to three ISO Guides and to the ISO/IEC Directives Part 1).1
Correction and corrective action are still required in ISO 9001:2015 and are addressed in clauses 9 and 10. In simple terms, an organization is required to react to nonconformity and take action to control and correct it, and to deal with the consequences. For correction, clause 9 also requires an organization to take appropriate correction without undue delay.
The organization also is required to evaluate the need for action to eliminate the cause(s) of the nonconformity to ensure that it does not recur or occur elsewhere. To accomplish this, the organization is required to review the nonconformity, determining the causes of the nonconformity and determining whether similar nonconformities exist, or whether conditions exist under which similar nonconformities may occur.
An organization also is required to implement any necessary action, review the effectiveness of corrective actions and make appropriate changes to its QMS if changes are necessary.
ISO 9001:2015 notes that corrective actions shall be appropriate to the effects of the nonconformities encountered.2
So far, the requirements are not much different from those in ISO 9001:2008.