Templates and records · ISO 9001 · Clause 10.2
ISO 9001 nonconformity report template
The record auditors look at most: it shows that the company detects what goes wrong, puts it right, understands why it happened and checks that it does not happen again.
In one sentence
An ISO 9001 nonconformity report records which requirement was not met, the immediate correction, the cause analysis, the corrective action with its owner and deadline, and the verification that the action was effective, because clause 10.2.2 requires evidence to be retained of the nature of each nonconformity, the actions taken and their results.
- Where the standard requires it
- ISO 9001 · Clause 10.2 Clauses are cited using the numbering of the 2015 edition, the same one the Academy uses; certificates issued against it remain valid during the transition to the 2026 edition.
- Type of information
- Mandatory record Documented information to be retained (10.2.2)
- Who fills it in
- Whoever detects it, plus the process owner Anyone can raise it; the owner of the affected process takes on the analysis and the action, and quality verifies closure
- When
- As soon as it is detected Effectiveness is verified later, once enough time has passed to see whether the failure recurs
- How long it is kept
- Set by the organisation The standard sets no periods: it asks you to decide on retention and disposition (7.5.3.2). Covering at least the three-year certification cycle lets you show the history at recertification.
What the standard requires
What ISO 9001 demands and what it leaves to your judgement
When a nonconformity occurs, including customer complaints, the standard asks you to react — control it, correct it and deal with the consequences — and then decide whether action on the cause is needed so that it does not recur or occur elsewhere. If you act, you must review the effectiveness of the action and, where appropriate, update risks and opportunities or change the system.
What must be recorded is the nature of the nonconformity, the actions taken and the results of the corrective action. No particular analysis method is required: five whys, Ishikawa or another, what matters is that the cause you write down explains the failure rather than simply describing it.
Correction and corrective action are not the same thing, and the report should keep them apart: the first repairs today's effect; the second removes the cause for tomorrow.
Structure
Fields the template should include
- Number, date of detection and who detected it
- Source: internal or external audit, customer complaint, process, supplier
- Requirement not met (from the standard, the customer, the law or the system itself)
- Objective description of what happened and evidence
- Immediate correction and handling of the consequences
- Root cause analysis and method used
- Review of whether similar cases exist or could occur
- Corrective action, owner and target date
- Verification of effectiveness: date, criterion and result
- Update of risks or changes to the system, where applicable
- Closure date and who closed it
Example
Example: nonconformity due to incorrect labelling
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Number and date | NC-2026-031 · 3 February 2026 |
| Source | Customer complaint received by the sales department |
| Requirement not met | Labelling specification agreed with the customer (customer requirement) |
| Description | A pallet of 48 cases left with labels from the previous batch; the customer spotted it at goods-in |
| Correction | Relabelling at the customer's premises the same day and inspection of the two pallets awaiting dispatch |
| Root cause | Five whys: a batch changeover does not require leftover labels to be removed from the line printer |
| Similar cases? | Same risk on line 2, which shares the procedure |
| Corrective action | Add removal and sign-off of leftover labels on lines 1 and 2 to the batch changeover record · Production manager · 20 February |
| Verification of effectiveness | 15 May: 62 batch changeovers reviewed with no incidents · Effective |
| Risks | "Incorrect labelling at batch changeover" added to the packing process risk register |
At the audit
Mistakes auditors commonly flag
- The root cause restates the problem in other words ("human error", "operator oversight").
- The correction is recorded and the case closed with no corrective action and no justification for why none is needed.
- Effectiveness is "verified" on the same day the action is implemented.
- Customer complaints are handled separately and never reach the nonconformity log.
- Recurring nonconformities are not linked to each other and never update the risk register.
In Kimobox
How this record is kept in Kimobox
- 1Any user can raise the nonconformity with its evidence and a classified source: audit, complaint, process or supplier.
- 2The root cause is mandatory to move forward: you cannot proceed to action with a correction alone.
- 3The corrective action is assigned to an owner with a date, and the system warns you if it slips.
- 4Verification of effectiveness is scheduled for a later date and forms part of the same record; recurring nonconformities feed the risk map.
Frequently asked questions
What people ask us before getting started
Does every nonconformity need a corrective action?
No. The standard asks you to evaluate whether action on the cause is needed, and the action must be proportionate to the effects. What cannot be missing is a reasoned decision: if no corrective action is opened, the record has to explain why.
What is the difference between correction and corrective action?
Correction eliminates the detected nonconformity — relabelling the pallet; corrective action eliminates its cause so that it does not recur — changing the control at batch changeover. ISO 9000 defines the two separately.
When is effectiveness verified?
Once enough time or volume has passed for the failure to have reappeared if the cause were still there. Verifying it on the day of implementation only proves the action was carried out, not that it works.
Keep your ISO 9001 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
IATF 16949 8D report template for customer complaints
How to complete an 8D under IATF 16949 (10.2.3): team, problem, containment, occurrence and non-detection…
ISO 14001 environmental nonconformity report template
How to document an environmental incident or nonconformity under ISO 14001 (10.2): mitigating impacts…
ISO 27001 information security incident log template
What an information security incident log should record under ISO 27001 controls 5.24 to 5.28: assessment…
ISO 37301 internal investigation report template
What a compliance investigation report must record: facts, inquiries made, rights of the person…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 9001:2015 — Quality management systems. Requirements ISO · 2015 ed., with Amd 1:2024
- ISO 9000:2015 — Fundamentals and vocabulary ISO · 2015 ed.
- ISO 9001:2026 — Quality management systems. Requirements ISO · 2026 ed., published 16 September 2026