Corrective and preventive action procedure

Purpose

To make sure problems found by audits, incidents, complaints and checks are fixed at their cause, that the fix is checked, and that the same problem is prevented elsewhere in the business.

Scope

Every nonconformity from an internal or external audit, inspection, incident, near miss, complaint or failed check that needs more than an on-the-spot fix. It applies to every site and team.

Responsibilities

Definitions

Correction

The immediate fix for the problem in front of you.

Corrective action

An action that removes the cause of a problem so it doesn't happen again.

Preventive action

An action that stops the same cause creating a problem somewhere else, before it does.

What you need

• The corrective action register

Procedure

1. Raise the issue

   Add it to the corrective action register the day it's found, with what was found, where, by whom and how it was found.

2. Contain it

   Do what's needed now to stop harm, such as stopping a task, quarantining stock or fixing a record, and note what was done.

   Caution: If anyone could be hurt, or personal data is exposed, contain it first and follow the incident or data breach procedure.

3. Set a priority and an owner

   Rate it low, medium, high or critical by the harm it could cause, and give it an owner and a due date to match.

4. Find the root cause

   Ask why it happened, and keep asking why until you reach something the business can change, such as a missing step, unclear training or the wrong tool.

   • Talk to the people who do the work
   • Check whether it has happened before
   • Avoid stopping at "human error"; ask what made the error easy

5. Choose and plan the action

   Pick an action that removes the cause, such as changing the procedure, retraining, adding a check or fixing equipment. Agree what done looks like.

6. Look for the same cause elsewhere

   Check whether other sites, teams or processes have the same weakness, and add preventive actions for them.

7. Carry out the action

   The owner does the work by the due date, updates the register, and keeps the evidence, such as the new procedure version or training records.

8. Check it worked

   After enough time has passed, the checker looks for evidence that the problem hasn't come back, such as a clean audit or no repeat incidents.

9. Close it, or reopen it

   If it worked, the checker records the result and closes the action. If not, it goes back to step 4.

10. Review trends

    Each quarter, review closed and open actions by cause and area, and raise bigger actions where the same cause keeps showing up.

Records

• The corrective action register, with each action from raised to closed.
• Evidence of each action and its check.
• Quarterly trend reviews.

Related documents

• Internal audit procedure
• Incident reporting procedure
• Complaint handling procedure

Revision history