The Corrective Action Process: 8 Steps as Run on the Floor

The corrective action process is the closed loop a quality system runs after a confirmed nonconformance. The clauses in ISO 9001, IATF 16949, AS9100, ISO 13485, and FDA 21 CFR 820.100 describe the same loop in slightly different language. The version below is how the loop is actually run on the floor — by quality engineers, supervisors, and supplier quality engineers who live in CAPA every week. See the broader corrective action guide for context.

Step 1 — Intake

The trigger. An internal NCR, a customer complaint, a field return, a supplier reject (which usually generates a SCAR), an internal or external audit finding, or a process monitoring alarm. Intake captures what, where, when, how many, severity, and whether the customer needs notification (in automotive, the clock on 24-hour customer notification often starts here).

Owner: Quality engineer for the affected line, or supplier quality engineer if the source is a SCAR. Evidence to close: CAR number assigned, source record linked, severity classified, owner and target dates set. Failure mode if skipped:records that cannot be traced back to a source nonconformance fail audit cross-referencing every time.

Step 2 — Containment

Stop the bleeding before investigating the wound. Typical containments: 100% inspection of suspect lots, quarantine of finished goods, sort at the customer site, added inspection at the next operation, stop-ship on open shipments. Containment scope must name lots, locations, and quantities — not just "100% inspection."

Owner: Production supervisor with quality engineer support. Evidence to close: sort report with quantities, quarantine record, stop-ship confirmation, customer notification record where required. Failure mode: containment that does not cover all suspect inventory is the source of most repeat customer complaints on the same defect.

Step 3 — Root cause analysis

Identify why the defect occurred (occurrence cause) and why the existing controls did not catch it (detection cause). The method is chosen to fit the severity and complexity: 5 Whys for lighter issues, Fishbone for multi-factor problems, 8D for customer complaints (especially in automotive), Fault Tree Analysis for safety-critical failures. See root cause analysis methods for the technique.

Owner: Cross-functional team led by the responsible quality engineer.Evidence to close: the analysis worksheet (5 Whys, Fishbone, 8D D4), with both occurrence and detection causes stated separately. Failure mode: the single most common reason corrective actions fail effectiveness is a root cause that is really a restated symptom — "operator error" or "out of spec" — instead of a process, equipment, or control gap.

Step 4 — Corrective action plan

For each root cause, one or more specific actions with a named owner, a target date, and the evidence required for closure. Actions should move up the controls hierarchy where possible: elimination, engineering control or poka-yoke, process control change, detection control change, documentation update, training. A plan made entirely of training and procedure updates almost always recurs.

Owner: Lead quality engineer for the CAR; action owners are named individuals, never departments. Evidence to close: CAP table with all actions linked to root causes, owners, dates, evidence requirements. See the corrective action plan guide.

Step 5 — Implementation

Execute the plan. Update work instructions, control plans, PFMEA, inspection plans, training matrix, gage list, and operator training records. If the change affects a customer-approved process — PPAP, FAI, design history file — route through formal change control before going live on the floor.

Owner: Each action owner for their action. Evidence to close:the actual revised documents at their new rev level, with effective date. Failure mode: implementing on the floor before pushing the documentation revision creates a gap that fails the next layered process audit.

Step 6 — Verification of implementation

Someone other than the action owner confirms the action was actually done. Read the updated work instruction at the workstation. Watch the operator perform the new step. Pull the new inspection record from the line. Verification is not the same as the effectiveness check; it answers "did we do what we said we would do."

Owner: Quality engineer or designated verifier. Evidence to close: a signature, the date, the artifact verified (rev level, training record IDs, floor observation date). Failure mode: verification that consists of the action owner signing their own action complete is rejected by every surveillance auditor.

Step 7 — Effectiveness check

After a defined period — typically 30, 60, or 90 days, or a defined number of production runs — check that the defect has not returned. The acceptance criteria should have been written when the plan was written, not invented at the effectiveness review. Typical criteria: zero recurrence in N units, no related complaints in N days, Cpk above a threshold, zero failed audits on the modified inspection point. See the dedicated effectiveness verification guide for the data sources and the patterns that fail audit.

Step 8 — Closure and read-across

Close the record with all evidence attached, then perform the read-across: does the same root cause exist on similar parts, similar processes, sister lines, or other plants? Read-across is the single most heavily audited part of CAPA in IATF 16949 and AS9100 surveillance because it is also the most commonly skipped. A closure with no read-across is almost always re-opened the next time the same cause surfaces on a parallel part.

Owner: Lead quality engineer. Evidence to close: the list of parts, processes, or sites reviewed, with disposition (no action, action opened — link to new CAR) for each. Approval signatures and date closed.

FAQ

How many steps are in the corrective action process?

Eight: intake, containment, root cause, action plan, implementation, verification of implementation, effectiveness check, and closure with read-across. The 8D method maps almost one-to-one onto these steps; D1 (team) sits inside intake, D7 is read-across, D8 is closure.

Who owns the corrective action process?

Quality typically owns the process and the CAPA system, but each individual corrective action is owned by a named engineer or supervisor responsible for the line, cell, or supplier where the issue occurred. Departmental ownership is one of the most reliable predictors of a missed due date.

How long does a corrective action take?

Containment in 24-48 hours, root cause in 14 days, action plan in 30 days, effectiveness check at 60-90 days. These align with the automotive 8D timeline and are the default in most aerospace and medical device programs.

What is the difference between this process and the CAPA process?

The corrective action process is the response to a confirmed nonconformance. CAPA is the broader system that includes corrective action and preventive action, often with explicit risk assessment and regulatory recordkeeping requirements. See the CAPA process and CAPA vs corrective action.

What standards require this process?

ISO 9001 clause 10.2, IATF 16949, AS9100, ISO 13485, and FDA 21 CFR 820.100 all require a documented corrective action process with evidence of root cause analysis, action implementation, and effectiveness verification.