Corrective Action Report: What Goes In It and Who Reads It

A corrective action report (CAR) is the written record of a corrective action — what the problem was, why it happened, what was done about it, and how you know it worked. It is read by two audiences: internal management and quality engineering, and external customers or auditors. The format is similar for both, but the evidence and tone differ. See the corrective action process for the underlying loop.

What a corrective action report is (and isn't)

The report is the deliverable, not the activity. The activity is the corrective action process — containment, root cause, action plan, verification, effectiveness check. The report is the document that summarizes the activity in a form someone outside the team can review. A complete report should let an auditor or customer reach the same conclusion you did without needing to interview anyone on the line.

A report is not a status update, a meeting summary, or a marketing reply to a complaint. It is a formal quality record, retained for the period required by the applicable standard (ISO 9001 typically 3 years, IATF 16949 typically the life of the part plus one year, ISO 13485 typically the device lifetime).

Internal report vs customer-facing report

The internal CAR is the working document. It contains all evidence, full RCA detail, the action plan with owners and dates, and the effectiveness data. It is the version that survives audits.

The customer-facing report is a derived view. It contains the same sections, but commercially sensitive details (specific operator names, internal cost data, unrelated trade-secret process parameters) are typically redacted or summarized. Most automotive and aerospace customers require the 8D format for the customer-facing report.

The 8D format

8D is the de facto standard for customer-facing corrective action reports in automotive and large-OEM aerospace. The eight disciplines are:

1. D1: Establish the team — names, roles, champion.
2. D2: Describe the problem — what, where, when, how many, how detected.
3. D3: Interim containment actions — scope, owners, dates, evidence.
4. D4: Root cause analysis — occurrence and detection, method used.
5. D5: Permanent corrective actions — actions, owners, dates, evidence.
6. D6: Implement and verify — confirmation each action was done.
7. D7: Prevent recurrence — system changes (PFMEA, control plan, work instruction, lessons learned, read-across to similar parts).
8. D8: Recognize the team — close-out, acknowledgments.

Many customers expect the 8D delivered in stages: D1-D3 within 24 hours of complaint, D4-D5 within 15 days, D6-D8 within 30 days, plus a 60- or 90-day effectiveness verification. The plan that backs the 8D is the same plan covered in the corrective action plan guide.

Sections a complete report should contain

Whether the format is 8D, a customer-specific form, or an internal CAR, the report needs:

• Identifier, source reference, dates, customer name where applicable.
• Team members and the champion or owner.
• Problem statement written for an outside reader.
• Containment actions with scope, owners, and evidence references.
• Root cause analysis (occurrence and detection separately).
• Action plan with one row per action, owner, due date, evidence.
• Verification of implementation — confirmation each action was done.
• Effectiveness check — criteria, data, disposition.
• Read-across — similar parts, processes, or sites reviewed.
• Closure — approval signatures and date.

Evidence package

The evidence package is what makes the report auditable. Typical contents: revised work instruction with rev level and date, updated PFMEA pages, updated control plan pages, training records for the affected operators, before/after photos of any equipment or fixture change, capability or SPC data from the effectiveness period, and the closed source NCR or complaint with traceability back to the report.

Customer-facing reports often attach a redacted subset. Internal records keep the full package. The retention period is set by the applicable standard and the customer's specific requirements.

Corrective Action Request vs Corrective Action Report

The two terms are often used interchangeably and that creates confusion. A Corrective Action Request is the document that initiates the process — typically issued by a customer, a supplier quality engineer, or an auditor — and it asks for a corrective action to be performed. A Corrective Action Report is the document that closes the process — it is the response to the request, with the completed plan, verification, and effectiveness data. The supplier-facing version of the request is the Supplier Corrective Action Request (SCAR).

Pre-send checklist for a customer report

• Problem statement contains what, where, when, how many, how detected.
• Containment scope is specific — lots, locations, quantities.
• Both occurrence and detection root causes are stated, not just one.
• At least one corrective action is an engineering control or poka-yoke, not only training or procedure update.
• Every action has a single named owner and a specific date.
• Effectiveness criteria are measurable and the data source exists.
• Read-across to similar parts or processes is documented.
• The source nonconformance is traceable from the report.
• Evidence package is attached or referenced.
• Format matches the customer's required template (8D or equivalent).

For the report structure as a fillable file, see the corrective action plan template. For real reports worked end-to-end, see corrective action examples.