4.14. Corrective and Preventive Action

4.14.1. General

You are required to take corrective and preventive actions based on any customer complaint, service failures, audits of operations, and quality records. This action must look for the root cause the problem and put corrective procedures and practices in place that will prevent future occurrences. Your organization must put controls in place to ensure that all corrective actions are carried out, that they have been effective, and that the associated effort is commensurate with the potential risk to the customer.

To address this subsection:

• You must establish a documented system that addresses nonconformance within your operations. This system must not only correct the problem, but also address methods to prevent reoccurrence.
•  Whereas there are usually multiple occurrences of nonconformity, a managed system must be in place whereby a "severity" weighting is applied with regard to resource allocations to fix the problems.
• Your corrective action and preventive action processes must reference/record the corrected procedures that resulted this activity.

4.14.2. Corrective Action

You must maintain a documented system with records that effectively collect and resolve complaints as well as product failures.

The corrective action procedure must address:

• Collection and recording of customer complaints and product nonconformance.

This requires a documented system on how you handle, track, and resolve nonconformance.

• An investigation of the nonconformance and a record of the investigation.

This means performing a recorded investigation related to the complaint.

• Determining what needs to be done to correct the problem and the intended action to be taken.

This requires establishing a corrective action that will remedy the cause of the problem.

• Put controls in place to ensure the corrective action is taken.

This means fixing the cause of the problem and confirming that your fix worked.

4.14.3. Preventive Action

You must have procedures in place to systematically review your operations to ensure compliance to your quality plan.

To meet this requirement, your preventive action process must address:

• Collection and recording of information of nonconformances around your business operations that affect product quality. Some of these information source are internal audits, out-of-box audits, service reports, quality records, and customer complaints.

This means engaging in a review of your operations with information from internal audits, quality records, service reports, and customer complaints. The intention is to use the records to eliminate the cause of these nonconformities.

• An investigation of the nonconformance and a record of the investigation.

Create a plan to eliminate these nonconformities.

• Determining what needs to be done to correct the problem.

Execute your corrective plan and ensure that is was effective in eliminating the problem.

• Initiation of a corrective action that addresses the root cause of the problem to prevent its reoccurrence.

Ensure that the appropriate actions taken to remedy the nonconformities have been reviewed by management. This would include not only the corrective response, but the procedures that have been upgraded in response to the nonconformity.

• Ensure management reviews both the actions taken and the referenced procedures are updated accordingly.