Corrective actions only help an SME once the same error occurs less often or its consequences are reliably contained. A completed task says little about that. Whoever replaces a wrong delivery has looked after the customer; why the mix-up was possible remains open. This guide shows a practical CAPA process from the first safeguard to proven effectiveness. The working steps described are practical recommendations; where the ISO 9001 standard is touched, this is stated expressly.
Telling correction and root cause treatment apart
In everyday work three tasks lie close together. First you contain the consequences of an identified problem. Then you clarify how it could arise. Afterwards you change the process so that the confirmed cause is dealt with. The term CAPA stands here as a working term for corrective and preventive actions (Corrective and Preventive Action). It means neither a prescribed scope of forms nor a particular number of analysis steps.
An immediate action can hold back an affected delivery. The correction can consist of assigning wrongly packed goods correctly. An action aimed at the cause could be an unambiguous article marking at the packing station. These differences help with responsibility: whoever cleans up the acute case does not automatically need the authority to change the whole process.
Set a company rule on which cases need an in-depth analysis. Repetitions, unclear causes and significant effects are sensible triggers. You can treat a simple typing error differently from a mix-up of safety-relevant components. The decision and its reasoning should remain traceable later.
What ISO 9001 says about it
If your company works to ISO 9001 or wants to be certified, the standard deals with nonconformities and corrective actions in a chapter of its own (clause 10.2 in the 2015 edition). The terms come from ISO 9000: a correction eliminates a nonconformity that has been found, a corrective action eliminates its cause and is meant to prevent recurrence. The ISO 9001 Auditing Practices Group (an informal group of experts from ISO/TC 176 and the International Accreditation Forum; its papers are not formally endorsed by ISO and IAF) describes the response to a nonconformity in three parts: correction, root cause analysis and corrective action. Auditors check whether documented information and evidence exist for all three parts, and verify effectiveness. Complaints are a frequent trigger for such cases.
The APG does not prescribe a particular method; it names a range from simple brainstorming to systematic techniques such as root cause analysis, fishbone diagram (Ishikawa) or 5×Why. 5×Why, the Ishikawa diagram or the 8D report are practical tools, not requirements of the standard. According to the literature, 5×Why was described at Toyota by Taiichi Ohno, who traced it back to Sakichi Toyoda; the criticism is that it makes it easy to stop at a symptom.
On the edition: The clause number 10.2 comes from the ISO 9001:2015 edition. Since 16 September 2026 the ISO 9001:2026 edition has applied; the 2015 edition has been withdrawn (ISO, SNV). We have not checked against the licensed text of the standard whether number and content are unchanged in the new edition. Clarify transition periods with your certification body. This guide does not reproduce text of the standard and does not prove conformity for certification.
Opening a case clearly
Describe the observed state, the expected state and the visible deviation. “Packaging defective” is too vague for that. More helpful is: “The two variants were in the same bin; the delivery note names the longer variant, the parcel contains the shorter one.” Separate observations from assumptions, and add photos or document references only where they actually explain something.
Record the scope affected: order, article, process step and possibly further cases. If the scope is unknown, write exactly that. A first estimate may change later. It should not, however, be carried forward unnoticed as a finally verified fact.
Appoint a person who coordinates the case, as well as the people for containment and analysis. Agree the next feedback date internally. Check commitments specific to the customer separately. This guide deliberately gives no general processing deadline. For complex cases with several bodies involved, a more comprehensive case structure such as the 8D report is suitable; the scope should match the importance of the problem.
Investigating causes with evidence
Start with the actual process. Who received which information? Which variant was recognisable at the workstation? Where could the deviation have been noticed? Collect possible explanations openly at first and then test them against existing documents or a targeted observation. A plausible story is not yet evidence.
The question “why” can help to get from an immediate action to the working conditions. You do not have to reach a fixed number of repetitions. With several influencing factors, a presentation by category can be clearer, for example by people, machine, method, material, environment and measurement. This structure, too, is a practical aid, not a definitive list of causes.
“Inattention” usually ends the investigation too early. Ask why the mix-up remained possible despite normal working conditions and why the existing check did not detect it. Perhaps the master data were correct, but the label was hidden at the packing station. Then renewed training alone would not change the working condition.
Also record rejected explanations with a short reason. This prevents the next meeting from dealing with the same assumptions all over again. If several causes remain possible, document the uncertainty and plan an investigation that can distinguish between them.
Planning actions and verification together
Formulate an action as a verifiable change. “Raise the team’s awareness” leaves open who will do what differently afterwards. “Separate article variants spatially, adjust the bin labelling and check the assignment with a trial order” is concrete. Every task gets a responsible person, an agreed date and an expected piece of evidence.
Define before implementation how you want to recognise the effect. That can be an observed sample, an evaluation of comparable cases or a combination. Choose a period in which the process concerned actually takes place. A quiet week without a matching order gives no reliable statement about error prevention.
Distinguish checking implementation from checking effect. A new label is implemented when it is attached correctly. Its effect shows only in use. Also check side effects: does the packing route get longer, do new bottlenecks arise or does another variant become harder to recognise?
If the action does not work, reopen the processing. First check whether it was implemented as planned. Then question the cause and the solution chosen. A negative check is a professionally valuable result, as long as it does not disappear into the status “done”.
Practical example: Muster Montage AG
Muster Montage AG is a fictitious company. In a self-chosen sample of forty comparable deliveries it finds four variant mix-ups. That equals four divided by forty, so ten per cent. The figures illustrate the process and describe neither an industry value nor an acceptable error rate.
The team first stops the packing orders affected and checks the stock provided. The analysis shows two similarly named bins directly next to each other. The job tickets carry unambiguous article features; the bin labels lack them. The suspected cause is tested by re-enacting the packing operation.
As actions, the head of the warehouse adds the features to the labels and separates the variants spatially. A second person compares labelling, article and job ticket. After that, forty matching deliveries are observed again.
| Observation | Deliveries | Mix-ups | Share |
|---|---|---|---|
| Before the actions | 40 | 4 | 10% |
| After the actions | 40 | 1 | 2.5% |
The result is better but does not meet the self-set objective of “no mix-up in the observation series”. The case remains in processing. In the remaining deviation, a pre-assembled package had been used. The team therefore extends the investigation to this side process. It does not claim a proven lasting success from a single better sample.
Closure and handling of personal data
A sound closure names the problem, the confirmed cause, the changes implemented, the basis of verification and the result. Residual uncertainties belong in it too. Transferable findings can flow into work instructions or a knowledge collection. If the case stems from a customer complaint, align the feedback to the customer with complaint management.
If the case contains personal data, the principles of Art. 6 of the Federal Act on Data Protection (DSG) apply: under para. 2, processing must be in good faith and proportionate; under para. 3, personal data may be collected only for a specific purpose that is recognisable to the person concerned and processed only in a way compatible with it; under para. 4, they are destroyed or anonymised as soon as they are no longer needed for the purpose. Art. 8, para. 1 DSG requires data security appropriate to the risk. For this reason, preferably describe the process conditions and avoid unnecessary personal judgements. A blanket retention period cannot be derived from this.
Checklist
- Observation and assumption are described separately.
- Cases affected are delimited or expressly still unclear.
- Immediate action and root cause treatment have people responsible.
- The cause is supported by observation or documents.
- Every action has a date and proof of implementation.
- The verification criterion and the basis of observation are set in advance.
- Missing effect leads back into processing.
- Closure and transferable findings are documented.
How KMU | base helps
In QMS | base you find cases under “Day to day” at Reports. In the report a bar shows where the case stands (Reported, Clarify, Carry out actions, Check effectiveness, Closed), and a note names the next step in words (guided workflow for each report).
In the section “Root cause analysis and correction” you use CAPA with root cause analysis to record the immediate action, the root cause analysis with 5×Why, Ishikawa or free-form, the cause and the costs in CHF. With the Ishikawa method the categories People, Machine, Method, Material, Environment and Measurement are available. The professional assessment of the evidence and the choice of the suitable solution remain with you.
The tasks themselves are brought together in one place by actions from all sources, under “Day to day” at Actions: from reports, risks, changes, controls, forms, audits, reviews and meetings. That makes the shared overview easier but replaces no decision on priority and resources. With effectiveness for each action you assess completed actions as effective or not effective; every check stays in the history with person, date and result. If an action is not effective, it goes back into work.
With the effectiveness check on the report you plan a check date and record the result before the report is closed. This is built in as binding: for errors, complaints and near misses, the report can be closed only when a cause has been recorded, at least one action exists, all actions are done and effectiveness has been confirmed as effective. If you assess the effectiveness of the report as not given, QMS | base requires a note; if the report was already in the effectiveness check, it goes back to the actions.
The escalation of overdue reports and actions informs the people responsible first and, after the set number of days, the QM lead as well. A status set on time is no proof of effectiveness; therefore check the substance of the closure.
The guide to QMS | base explains how to use it. Take a look at the demo, open a trial account or write to us via the contact page.
Sources
- SNV: SN EN ISO 9001:2026, Quality management systems – Requirements, valid since 16 September 2026, replaces the 2015 edition; SN EN ISO 9001:2015, withdrawn as of 16 September 2026 (in German). Accessed 27.10.2026. The clause number 10.2 comes from the 2015 edition and has not been checked against the text of the 2026 edition; the text of the standard is subject to a charge.
- ISO: ISO 9001:2026, Edition 6, published on 16.09.2026, accessed 27.10.2026.
- ISO 9001 Auditing Practices Group: Guidance on Nonconformity – review and closing, Edition 1, 13.01.2016; the APG is an informal group, its papers are not formally endorsed by ISO and IAF; accessed 27.10.2026.
- Wikipedia: Five whys, description of the method (practice, not a standard), accessed 27.10.2026.
- Federal Act on Data Protection (DSG, SR 235.1), Art. 6, paras. 2–4 and Art. 8, para. 1, version of 7 July 2025 (German original), accessed 27.10.2026.
The organisational processes and examples are editorial practice aids. They do not reproduce ISO standard text and do not prove conformity for certification.
This guide does not replace legal or tax advice. Information as at 27 October 2026.