Managing Non-Conformities
An essential part of the effective operation of your management system is the corrective action and improvement process. During your third party audits by NQA, we may find situations where your system, process or practices are non-compliant with the standard being audited. When this occurs your auditor will raise a non-conformity against your organisation. The nonconformity will detail which requirement of the standard/regulation has not been met and what evidence the assessor found in order to justify the non-conformity.
Major, Minor, or Opportunities for Non-Conformance Management Improvements
The auditor will determine whether the non-conformity is to be graded a major or a minor. Majors are issued when there is a failure to fulfil one of the requirements of the standard or a situation arises where there is doubts that your management system can deliver its intended outputs. Minors are given where this is not the case or where a single lapse in a system or process is found. The auditor may also issue opportunities for improvement (OFIs) which are suggestions as to how to improve your system.
At a Stage 1 audit the auditor will raise Areas of Concern (AoC) which identify where your system is not yet compliant to the requirements and would result a non-conformity being raised at a Stage 2 audit. You are not required to respond to an AoC Stage 1 however, the extent to which AoCs are identified at your Stage 1 audit will influence whether the auditor will recommend progression to the Stage 2 audit.
You will have an opportunity to discuss the non-conformity at the time it is raised and also at the closing meeting. The assessor will advise you as to the grading of the non-conformity and what action is required. In certain circumstances NQA may need to revisit your organisation to ensure that non-conformities have been addressed.
Non-conformities which are raised by your auditor will be detailed on your audit report. Your response to the raised non-conformities should be detailed on the NQA Audit Non Conformance and Corrective Action Submission Form. This form provides areas to detail how your organisation has dealt with the non-conformity.
Unless otherwise stated, you are required to submit responses to minor non-conformities within 90 days and responses to major non-conformities within 10 days of your audit completion. This applies to Stage 2, Surveillance, Recertification and Special Visits. Your submission must use the NQA Audit Non Conformance and Corrective Action Submission Form. Failure to do so may put your certification at risk of suspension. You do not have to provide responses to opportunities for improvement (OFIs).
Please note that certification will not be issued, reissued or revised unless all outstanding non-conformance responses have been submitted and in the case of a major non-conformity the evidence of correction has been provided and accepted by NQA.
Non-conformance responses should be emailed to caps@nqa.com.
The NQA Audit Non Conformance and Corrective Action Submission Form will be provided to you by your auditor. If you require a copy of the form please email enquiries@nqa.com.
You have the right to formally appeal against a non-conformity which will result in an independent review. More information on appeal can be found here.
Completing the NQA audit non conformance and corrective action submission form
The purpose of the NQA Audit Non Conformance and Corrective Action Submission Form is to demonstrate that your organisation has an effective management system and is able to immediately address non-conformities, understand why they have occurred and put in place actions to ensure that the non-conformities do not repeat themselves.
The completion of the Corrective Action Submission Form should be an output of your own corrective action process (for example required by clause 10.2 in ISO 9001:2015). This requires you to fix the immediate issue identified (containment), understand why it happened (root cause) and make appropriate changes to make sure it is not repeated (corrective action). The NQA Audit Non Conformance and Corrective Action Submission Form asks you to detail how you have undertaken these steps and provide evidence.
The responses on this form should be succinct but provide enough information for NQA to establish whether you have effectively addressed the non-conformity using the steps identified above.
The completed Corrective Action Submission Form should be emailed to caps@nqa.com within the defined timescales. You should also attach any supporting documentation which provides evidence that the steps detailed in the submission forms have been undertaken.
Principals of non-conformity
Resolving a non-conformity raised at a third party assessment follows the same principals as non-conformities raised at internal audits. It should follow a logical process to understand the issue raised and ensure it is put right.
Containment Action
In this section you should detail what was done to immediately rectify the non-conformity. It should also detail any temporary measures taken to stop any further non-conformities reoccurring. You should clearly detail what action you have undertaken and provide evidence that it was successful.
Non-Conformity Examples
Illustrative example 1: A blocked emergency exit on an OHSAS audit will result in a non-conformity. A possible Containment Action may be to unblock the emergency exit. Evidence of this being successful can be provided through an attached photograph.
Illustrative example 2: The auditor found that no internal audit had been conducted in the last 12 months and it there was no internal audit scheduled. The immediate corrective action could be to update the internal audit schedule and conduct an internal audit.
Root Cause Analysis
In the Root Cause Analysis section you should be able to demonstrate how you have effectively determined the underlying cause of the problem. There are a number of useful techniques available to help support this process.
- Fishbone (Ishikawa)
- 5Y
- 8D
NQA auditor Joe Kelly provides more information on 5Y in his Blog post on “Effective Correction Action Plan”. The objective of the root cause is to achieve a logical progression from the issue. Starting from the non-conformity back through the various causes and effects to the underlying cause. Depending on the non-conformity your root cause analysis may need to be attached as a separate document.
Corrective Action
Corrective action details what action you have taken to ensure that the non-conformity does not reoccurring. The Corrective action should directly address the root cause of the problem. You should provide evidence of what actions have been undertaken to support your claim that your Long Term Corrective action has effectively prevented the possibility that the non-conformity can reoccur.
The auditor will always verify your non-conformance responses at your next audit, in particular auditing whether your Long Term Corrective Action has been effective in preventing reoccurrences. Non-conformances will be raised against your corrective action process if your actions have not been found to be effective. This is one of the most common requirements in which major non-conformities are raised by assessors.
Multisite non-conformities
Where your business operates a multi-site certification you will receive a program of audits throughout each year. This program will select sub-locations/sites to audits and will be completed by a Head Office audit.
When non-conformities are identified at a sub-location/site, the auditor will document this on the audit report and raise the non-conformity against the location. Depending on the nature of the non-conformity the auditor may raise this against the sub-location/site or against the organisation’s overall system.
Where common issues have been found across multiple sub-locations/sites the auditor will raise a non-conformity against the overall management system. This is important because it will determine the expectations as to the corrective action and improvement activities put in place by the organisation. For example, if a single incident of non-conformity is found at a sub-location/site the root cause analysis may identify it is a one off occurrence due to an individual breakdown at that location.
Conversely, if common findings are occurring across the organisation this would be indicative of a systemic failing across the system and would require a root cause analysis and corrective action at an organisation-wide level. Whilst the auditor will attempt to make a judgment as to the extent of the non-conformity across your organisation, an effective root cause analysis process will determine this for you and allow you to take action accordingly.
You are required to respond to NQA for non-conformities raised at audits within 10 days for a major non-conformity and 90 days for a minor non-conformity from the end of the audit, unless otherwise instructed by your auditor.
At the final audit of your yearly audit program, the findings and non-conformities from the sub-location/sites will be collated and presented during the closing meeting. Those which have not been verified and closed will require to be closed out within the required time frame. Clients with administration days can use those days to review open findings with your lead auditor, they can also verify corrective actions taken.
This will happen at your Head Office audit and at sub-locations/sites based on where it is practical to verify corrective action implementation.