ISO 9001:2015 clause 10: Improvement
The 13 audit questions covering clause 10, each with the objective evidence to request, the nonconformities most often raised against it and what to sample. Part of the free ISO 9001:2015 gap analysis checklist, which holds 251 items across 7 clauses.
All 13 questions for clause 10
Open any row for its objective evidence, common nonconformities and auditor tips. You can check items off as you go. This browser remembers your progress across all 7 clauses of this checklist.
§10 Improvement
10.1 Does the organization identify and select opportunities for improvement and act on them to meet customer requirements and enhance customer satisfaction (improving products and services, correcting or preventing undesired effects, improving the QMS)?
- Evidence the organization actively identifies and SELECTS improvement opportunities - from analysis (9.1.3), audits, management review, and feedback - and acts on them, rather than improving only when forced by a problem.
- A spread of improvement aimed at the three 10.1 purposes: improving products/services, correcting/preventing/reducing undesired effects, and improving QMS performance and effectiveness.
- Improvement results and benefits realized - before/after performance, customer-satisfaction gains - demonstrating the improvements actually achieved something.
- Evidence improvement considers future needs and expectations, not only current requirements (anticipating where the organization needs to be).
- Resources and support behind improvement (link to 10.3) - showing it is a real activity, not an aspiration.
- Minor NC: No improvement activity beyond reactive corrective action - the organization fixes problems but does not proactively improve.
- Minor NC: Improvement opportunities are identified (in analysis or review) but never selected and acted on.
- Minor NC: Improvement is not aimed at customer requirements or satisfaction, so effort does not connect to customer outcomes.
- Observation: Performance is static year over year, indicating improvement is nominal rather than real.
Improvement is a fundamental requirement of ISO 9001. Organizations must actively seek and implement improvements across all aspects of the QMS. IMPROVEMENT FOCUS: - Meet customer requirements - Enhance customer satisfaction - Drive organizational success IMPROVEMENT TYPES (a-c): a) IMPROVE PRODUCTS AND SERVICES: - Meet current requirements better - Address future needs and expectations - Anticipate emerging customer needs - New product/service development - Feature enhancements - Quality improvements - Performance improvements - Reliability improvements - Innovation b) CORRECT, PREVENT, REDUCE UNDESIRED EFFECTS: - CORRECT: Fix immediate problems (see 10.2) - PREVENT: Stop problems from occurring (preventive action) - REDUCE: Minimize negative impacts - Reduce defects and waste - Eliminate root causes - Reduce variation - Reduce risks - Reduce costs of poor quality c) IMPROVE QMS PERFORMANCE AND EFFECTIVENESS: - Process improvements - System improvements - Efficiency improvements - Faster cycle times - Better resource utilization - Improved measurements - Better documentation - Enhanced capabilities IMPROVEMENT APPROACHES: CORRECTION: - Fix immediate problem - Quick response to issues CORRECTIVE ACTION (10.2): - Eliminate root causes - Prevent recurrence - Systematic problem-solving CONTINUAL IMPROVEMENT (10.3): - Ongoing, incremental improvements - Kaizen philosophy - Small, regular improvements BREAKTHROUGH CHANGE: - Major improvements - Significant leaps in performance - Process redesign or re-engineering INNOVATION: - New approaches - Novel solutions - Disruptive improvements - Technology adoption RE-ORGANIZATION: - Structural changes - New ways of working - Organizational transformation SOURCES OF IMPROVEMENT OPPORTUNITIES: - Customer feedback and complaints - Analysis and evaluation (9.1.3) - Internal audit findings (9.2) - Management review (9.3) - Nonconformities (8.7) - Employee suggestions - Benchmarking - Industry best practices - Technology advancements - Risk and opportunity analysis (6.1) IMPLEMENTATION: - Identify opportunities - Evaluate and prioritize - Select improvements to pursue - Plan and implement - Verify effectiveness - Standardize successful improvements
Review the improvement register or project list; select two improvement initiatives and verify they have defined objectives, measurable outcomes, and evidence of completion or progress.
- Beyond corrective actions, what proactive improvement initiatives has the organization launched in the past 12 months?
- How do you prioritize which improvement opportunities to pursue when resources are limited?
- Can you show me a measurable before-and-after comparison for a recent improvement project?
10.2.1 When a nonconformity occurs (including from complaints), does the organization react to it, evaluate the need to eliminate its cause so it does not recur or happen elsewhere, implement the action, and review the action's effectiveness?
- The corrective-action procedure - verify it requires the full 10.2.1 sequence (react/contain, evaluate whether root-cause action is needed, determine causes, implement, review effectiveness, update risks/opportunities, change the QMS) and defines when a nonconformity escalates from a simple correction to a formal corrective action.
- A sample of 5 corrective-action records (CARs) pulled from different sources - internal audit findings, customer complaints, scrap/process data, and external NCs - verify each shows containment, a genuine root-cause analysis, the action taken, and dated evidence it was completed.
- Root-cause analysis records (5-Why, fishbone, etc.) - check the analysis reaches a systemic cause an action can actually eliminate, and that the 'why' chain is not truncated at the first human-error answer.
- Effectiveness-review records - verify each closed CAR was re-checked after implementation to confirm the nonconformity did not recur, with objective evidence (data, re-audit, monitoring), not just a sign-off that the action was 'done'.
- The nonconformity/CAR log with trend analysis - look for the same nonconformity (or close variants) recurring across multiple CARs, which signals earlier corrective actions treated symptoms, not causes.
- Evidence corrective actions fed back into risks and opportunities (6.1) and into QMS changes (procedures, controls) where the nonconformity revealed a gap.
- Major NC: Recurring nonconformities (same defect, complaint, or audit finding appearing repeatedly) with no effective corrective action - the strongest evidence root causes are not being eliminated.
- Major NC: Corrective actions stop at correction - the immediate problem is fixed (rework, replace, re-issue) but no evaluation of the need to eliminate the cause is performed, so the system never improves.
- Minor NC: Root-cause analysis consistently lands on 'human error' or 'retraining required' without investigating the systemic conditions that allowed the error, so actions do not prevent recurrence.
- Minor NC: Effectiveness of corrective actions is never verified - CARs are closed when the action is implemented, not when evidence shows the nonconformity has not recurred.
- Minor NC: Customer complaints are resolved individually (replacement, refund) but do not enter the corrective-action process, so systemic complaint drivers are never addressed.
When problems occur, organizations must not only fix them but eliminate root causes to prevent recurrence. This is systematic problem-solving. SCOPE: - Any nonconformity (internal or external) - Customer complaints - Product/service nonconformities - QMS nonconformities - Process failures REQUIREMENTS (a-f): a) REACT TO NONCONFORMITY: 1) CONTROL AND CORRECT: - Immediate action to stop or contain problem - Fix the specific nonconformity - Correction (see also 8.7 for nonconforming outputs) - Containment to prevent spreading 2) DEAL WITH CONSEQUENCES: - Address impacts of the nonconformity - Customer notification if needed - Mitigation of effects - Recovery actions b) EVALUATE NEED FOR CORRECTIVE ACTION: Not all nonconformities require full corrective action - evaluate based on: - Severity and impact - Risk of recurrence - Frequency - Potential consequences 1) REVIEW AND ANALYZE: - Examine the nonconformity in detail - Gather facts and data - Understand what happened 2) DETERMINE CAUSES (ROOT CAUSE ANALYSIS): - Identify underlying root causes - Not just symptoms - Methods: 5 Whys, Fishbone diagram, Fault tree, etc. - May be multiple causes 3) CHECK FOR SIMILAR ISSUES: - Are there similar nonconformities elsewhere? - Could this happen in other processes/products? - Systemic vs. isolated issue - Broader implications c) IMPLEMENT ACTIONS: - Actions to eliminate root causes - Preventive measures - Process changes - Training - Procedure updates - Controls or checks - Actions must be APPROPRIATE to effects (proportionate) d) REVIEW EFFECTIVENESS: - Verify corrective action worked - Check that nonconformity does not recur - Monitor over time - Evidence of effectiveness - Close loop only when effective e) UPDATE RISKS AND OPPORTUNITIES: - If corrective action reveals new risks - If risk profile changes - Update risk register (6.1) - Adjust risk treatments f) MAKE CHANGES TO QMS: - Update procedures - Revise work instructions - Change processes - Update training - System improvements - Link to planning of changes (6.3) APPROPRIATENESS: - Minor issues: Simple corrective action - Major issues: Comprehensive root cause analysis and systemic changes - Effort proportionate to risk and impact RELATIONSHIP TO OTHER CLAUSES: - 8.7: Control and disposition of nonconforming outputs - 10.2: Corrective action (root cause elimination) - 6.1: Preventive action (risk-based thinking) KEY PRINCIPLE: - CORRECTION: Fix the problem (8.7) - CORRECTIVE ACTION: Eliminate the cause (10.2) - PREVENTION: Stop it before it happens (6.1)
Pull three recent CARs (one customer complaint, one internal audit finding, one process nonconformity); verify each includes correction, root-cause analysis, implemented action, and effectiveness review.
- Walk me through the full lifecycle of a recent nonconformity from detection through root-cause analysis to verified closure.
- How do you determine whether a nonconformity warrants a full root-cause investigation versus just a correction?
- Show me evidence that the risk register was updated as a result of a corrective action.
10.2.1.a On a nonconformity, does the organization react by taking action to control and correct it?
- Nonconformity reports with immediate actions
- Containment actions documented
- Corrections implemented and verified
- Evidence of timely response
- Nonconformities ignored
- No immediate containment
- Delays in correction
Immediate response to nonconformity: - CONTROL: Contain the problem, prevent further impact - CORRECT: Fix the immediate nonconformity - Quick action to limit damage - May include: rework, repair, scrap, re-service
Review two nonconformity reports and verify that immediate containment and correction actions are documented with timestamps showing timeliness.
- How quickly does the organization typically react to contain a nonconformity once it is detected?
- Show me a recent example where a nonconformity was contained before it reached the customer.
10.2.1.b On a nonconformity, does the organization deal with the consequences (for example customer notification, recall, service recovery)?
- Customer notification records
- Service recovery actions
- Consequence mitigation documentation
- Recall actions if applicable
- Consequences not addressed
- Customer impact ignored
- Required notifications missed
Address all impacts: - Customer notification if required - Recall or replacement actions - Service recovery - Managing customer dissatisfaction - Cost implications - Regulatory reporting if required
Select a nonconformity that had external impact; verify documented consequence analysis, customer notification (if applicable), and recovery actions.
- How do you identify all the downstream consequences of a nonconformity, including customer impact?
- Can you show me a case where a customer was notified and service recovery was provided?
10.2.1.c Does the organization evaluate whether action is needed to eliminate the cause(s) of the nonconformity so it does not recur or occur elsewhere (reviewing it, finding root causes, checking for similar cases)?
- Root cause analysis records
- 5-Why analysis or similar
- Review of similar processes/products
- Decision rationale for corrective action
- No root cause analysis
- Superficial analysis
- Similar issues not checked
Root cause analysis decision: - REVIEW: Understand what happened - ANALYZE: Investigate the nonconformity - DETERMINE CAUSES: Root cause analysis (5-Why, fishbone, etc.) - CHECK FOR SIMILAR: Could this happen elsewhere? Not all nonconformities need corrective action - evaluate based on: - Risk/severity of recurrence - Frequency - Impact on customer/quality
Pull two root-cause analysis records; verify the method used, depth of analysis beyond surface symptoms, and evidence that similar processes were checked for the same risk.
- What root-cause analysis method does your team use most often, and can you show me a completed example?
- How do you check whether a similar nonconformity could occur in a different process or product line?
10.2.1.d Are the corrective actions that are needed actually implemented?
- Corrective action implementation records
- Evidence of completed actions
- Updated procedures/training
- Process changes implemented
- Actions planned but not implemented
- Partial implementation
- Actions not completed
Execute corrective actions: - Planned actions implemented - Resources allocated - Responsibilities assigned - Timeline followed - Actions completed as planned
Review the corrective action tracker; select two actions and verify implementation evidence (updated procedure, training record, process change) against the planned completion date.
- How do you track corrective action implementation to ensure actions are completed on schedule?
- Show me a corrective action that required a procedure change and the evidence that the change was implemented.
10.2.1.e Is the effectiveness of any corrective action taken reviewed (did it eliminate the root cause; has the problem recurred)?
- Effectiveness review records
- Evidence of no recurrence
- Follow-up audits or checks
- Closure of corrective action
- No effectiveness verification
- Corrective actions closed without review
- Recurring nonconformities
Verify actions worked: - Did the action eliminate the root cause? - Has the nonconformity recurred? - Were there unintended consequences? - Evidence of effectiveness - Close the loop on corrective action
Select two closed CARs and verify each has a documented effectiveness review with specific evidence (e.g., no recurrence over a defined monitoring period, improved metric).
- How long after implementation do you wait before reviewing effectiveness, and what criteria do you use?
- Can you show me a case where an effectiveness review found the corrective action was insufficient and further action was taken?
10.2.1.f Are the risks and opportunities determined during planning updated when a nonconformity reveals the need?
- Updated risk register
- Risk reassessment records
- New risks identified from nonconformities
- Link between CAPA and risk management
- Risks not updated from lessons learned
- No link between CAPA and risk
- Systemic risks not recognized
Link to risk management: - Does the nonconformity reveal new risks? - Were existing risks underestimated? - Update risk register if needed - Adjust controls based on learning
Cross-reference the corrective action log against the risk register; verify at least one instance where a CAR triggered a risk reassessment or new risk entry.
- Can you show me an example where a corrective action led to an update in the risk register?
- How do you decide whether a nonconformity warrants a change to the risk profile?
10.2.1.g Are changes made to the QMS when a nonconformity shows they are necessary?
- Updated procedures from corrective action
- Process changes implemented
- Training updates
- QMS documentation revisions
- QMS changes not made when warranted
- Procedures not updated after incidents
- Systemic issues not addressed
System-level changes when needed: - Procedure updates - Process changes - Training modifications - Control enhancements - Structural QMS changes
Select a corrective action that required a QMS change; verify the document revision record, change communication (e.g., training, notification), and updated process.
- Show me a corrective action that resulted in a procedure revision or a process control change.
- How do you ensure that QMS changes triggered by corrective actions are communicated to affected personnel?
10.2.2 Does the organization keep records as evidence of the nature of nonconformities, the actions taken, and the results of corrective action?
- The retained corrective-action records (CARs, 8D, A3) - verify each captures the NATURE of the nonconformity (what, where, when, requirement breached, impact) and the actions taken.
- Evidence each record documents the RESULTS of the corrective action, including the effectiveness verification, not just that the action was implemented.
- Retrievability - confirm corrective-action records can actually be found and produced (link to 7.5), since they are evidence of systematic problem resolution.
- Closure approvals showing each CAR was reviewed and closed by an appropriate authority once effectiveness was confirmed.
- Trend/analysis reporting on corrective-action data feeding management review (link to 9.3.2).
- Minor NC: Corrective-action records are incomplete - the nature of the nonconformity or the results of the action are not documented.
- Minor NC: No documented evidence of effectiveness verification, so closure cannot be justified.
- Minor NC: Corrective-action records cannot be retrieved when requested, undermining their value as evidence.
- Observation: Corrective-action data is recorded per CAR but never analyzed for trends, missing systemic signals.
Corrective actions must be documented to ensure accountability, enable learning, and provide evidence of systematic problem resolution. DOCUMENTED INFORMATION REQUIREMENTS (a-b): a) NATURE OF NONCONFORMITIES AND ACTIONS: - Description of the nonconformity * What happened? * Where and when? * What requirement was not met? * Impact and severity * How discovered? - Immediate actions taken (correction) * Containment * Correction of the specific issue * Dealing with consequences - Root cause analysis * Investigation method used * Causes identified * Analysis and evidence - Corrective actions implemented * What actions were taken? * Who was responsible? * When implemented? * Changes to QMS (procedures, training, etc.) b) RESULTS OF CORRECTIVE ACTION: - Effectiveness verification * How was effectiveness checked? * Evidence that nonconformity does not recur * Monitoring period and results * Verification date and by whom - Outcomes and benefits * Did the corrective action work? * Performance improvements * Closure status PURPOSE OF DOCUMENTATION: - Accountability for problem resolution - Evidence for audits - Learning and knowledge management - Trend analysis - Input to management review - Verification of effectiveness - Prevention of recurrence - Organizational learning FORMS OF DOCUMENTATION: - Corrective Action Reports (CARs) - Corrective Action Requests - Nonconformance Reports (NCRs) with corrective action section - Problem-solving worksheets (8D, A3, etc.) - Quality management system records - Digital quality management system RETENTION: - Must be retained (not just created and discarded) - Accessible for review and analysis - Retained per document retention requirements MINIMUM INFORMATION: - What was the problem? - What did we do about it? - Did it work?
Select three corrective action records and verify each contains: a clear description of the nonconformity, root-cause analysis, actions taken, and documented effectiveness verification.
- Where is your corrective action documentation stored, and how do you ensure traceability from the nonconformity through to closure?
- Show me how you document both the nature of the nonconformity and the results of the corrective action in one record.
- How long do you retain corrective action records, and is that period defined?
10.2.2.a Do the records capture the nature of the nonconformities and the actions subsequently taken?
- Nonconformity reports/forms
- CAPA records with full documentation
- Description and classification of NCs
- Action records linked to nonconformities
- Nonconformities not documented
- Poor description of issues
- Actions not linked to NC records
Required documentation of nonconformities: - Description/nature of the nonconformity - Where/when/how discovered - Containment actions - Corrections made - Root cause analysis - Corrective actions implemented
Review three nonconformity records; verify each contains a clear, specific description of the nonconformity and traceable links to all subsequent actions.
- How do you ensure the description of the nonconformity in the record is detailed enough for someone unfamiliar to understand what happened?
- Show me how subsequent actions (containment, correction, corrective action) are linked to the original nonconformity record.
10.2.2.b Do the records capture the results of any corrective action?
- Corrective action closure records
- Effectiveness verification evidence
- Before/after comparisons
- Sign-off on action completion
- No closure documentation
- Effectiveness not recorded
- Missing verification evidence
Document corrective action outcomes: - Actions completed - Effectiveness verification results - Evidence of success/failure - Closure records
Select two closed corrective action records; verify each has documented results showing the action eliminated the root cause, including monitoring data or verification evidence.
- How do you document that a corrective action was effective, not just that it was completed?
- Show me the closure record for a recent corrective action, including the effectiveness evidence.
10.3 Does the organization continually improve the suitability, adequacy, and effectiveness of the QMS, using analysis results and management review outputs to decide where to act?
- Evidence of actual improvement activity - improvement initiatives, projects, kaizen/Lean/Six Sigma work, or a structured suggestion system - with records of what was changed and why.
- Before/after performance data - metrics moving in the right direction over time (defects, on-time delivery, satisfaction, cycle time) - demonstrating the QMS's suitability, adequacy, and effectiveness are genuinely improving, not just being maintained.
- The link from analysis (9.1.3) and management-review outputs (9.3) to the improvements pursued - showing improvement is driven by data, not chosen at random.
- Evidence improvement is resourced and supported - budget, time, training, or leadership sponsorship - rather than expected on top of day jobs with nothing behind it.
- A reasonable spread of improvement that is PROACTIVE, not only reactive correction of problems that already occurred.
- Minor NC: No demonstrable continual improvement - performance is flat or declining year over year and the same processes run unchanged.
- Minor NC: 'Improvement' consists only of corrective actions after problems occur, with no proactive improvement of suitability, adequacy, or effectiveness.
- Minor NC: Improvement opportunities are identified (in analysis or management review) but never pursued or resourced.
- Observation: Improvement activity exists but is disconnected from the analysis and management-review outputs, so effort is not aimed where the data says it matters most.
Continual improvement is a core principle of ISO 9001. Organizations must constantly seek to improve the QMS - it's not a one-time achievement. WHAT TO IMPROVE: SUITABILITY: - Is the QMS appropriate for the organization? - Does it fit the organization's context and needs? - Is it aligned with strategic direction? - Make the QMS more suitable over time ADEQUACY: - Is the QMS sufficient and complete? - Are there gaps or weaknesses? - Are resources adequate? - Ensure the QMS is comprehensive enough EFFECTIVENESS: - Is the QMS achieving intended results? - Is performance improving? - Are objectives being met? - Enhance results and outcomes SOURCES OF IMPROVEMENT NEEDS/OPPORTUNITIES: ANALYSIS AND EVALUATION (9.1.3): - Performance data analysis - Trends and patterns - Customer satisfaction data - Process performance metrics - Supplier performance - Nonconformity analysis - Audit findings MANAGEMENT REVIEW OUTPUTS (9.3.3): - Decisions on improvement opportunities - Changes to QMS - Resource allocation decisions - Strategic direction OTHER SOURCES: - Customer feedback and complaints - Employee suggestions - Internal audits (9.2) - Corrective actions (10.2) - Risk and opportunity analysis (6.1) - Benchmarking - Industry best practices - Technology advancements - Innovation opportunities CONTINUAL IMPROVEMENT APPROACHES: INCREMENTAL (KAIZEN): - Small, ongoing improvements - Regular, frequent improvements - Everyone involved - Continuous process BREAKTHROUGH: - Major improvements - Significant performance jumps - Process redesign or re-engineering - Transformational change SYSTEMATIC METHODS: - Plan-Do-Check-Act (PDCA) cycle - Lean methodologies - Six Sigma - Total Quality Management (TQM) - Continuous improvement programs - Innovation programs IMPROVEMENT CYCLE: 1. Identify opportunities (from analysis, review, etc.) 2. Prioritize opportunities 3. Select improvements to pursue 4. Plan improvement actions 5. Implement improvements 6. Measure results 7. Standardize successful improvements 8. Continue the cycle KEY DIFFERENCE FROM 10.2: - 10.2 (Corrective Action): Fix problems, prevent recurrence - 10.3 (Continual Improvement): Ongoing enhancement, even when no problems CULTURE OF IMPROVEMENT: - Leadership commitment to improvement - Employee engagement and empowerment - Resources allocated for improvement - Recognition of improvement achievements - Learning organization - Never satisfied with status quo - Always seeking to be better EVIDENCE OF CONTINUAL IMPROVEMENT: - Measurable improvements over time - Performance trends improving - Customer satisfaction increasing - Process capability improving - Defects decreasing - Efficiency increasing - Innovation and new capabilities
Review improvement project records and KPI trend charts; select two key metrics and verify a positive improvement trend supported by documented initiatives, not just random variation.
- What structured methodology (PDCA, Lean, Six Sigma, Kaizen) does the organization use for continual improvement, and can you show me evidence of its application?
- How do you distinguish continual improvement activities from routine corrective actions?
- Show me a performance trend that demonstrates measurable improvement over the past two years.
Each item shows its evidence, common nonconformities and auditor tips. The clause index has the PDF of all 251 items, formatted for a clipboard.
The rest of the ISO 9001:2015 gap analysis checklist
251 items across 7 clauses. Back to the clause index.