Codes & standards referenced
Cl 10.2 — Nonconformity and Corrective Action. The clause that drives every NCR/CAPA loop.
Internal audit programme — auditor checks that Cl 10.2 records exist and are being closed.
The auditor's process for tracking CAPA closure and effectiveness verification.
The "nonconforming product" side: low cube results become NCRs under Cl 10.2.
The five sub-clauses, read as a loop
| Sub-clause | What it requires | Site-side action |
|---|---|---|
| 10.2.1 | React to nonconformity; take action to control/correct; deal with consequences | Correction: quarantine the bad cubes, recall the load, halt the pour |
| 10.2.2 | Evaluate need for action; review NCR including complaints; determine cause(s); determine if similar could occur elsewhere | Root cause: 5-Why or fishbone, scan for similar NCs in other pours / batches |
| 10.2.3 | Implement any action needed | Corrective action: retraining, process change, calibration, document update |
| 10.2.4 | Review effectiveness of any action taken | Verify: test the next 30 m³ or the next batch, confirm non-recurrence |
| 10.2.5 | Update risks and opportunities | Update QMS: add to risk register, amend SOP, brief management review |
| 10.2.6 | Make changes to the QMS if necessary | Document: revision of SOPs, checklists, ITPs |
Reference: ISO 9001:2015 Cl 10.2.1 - 10.2.6. The six sub-clauses are a PDCA loop; 10.2.5 and 10.2.6 are often the most-skipped at construction sites.
Correction vs corrective action — the most-confused pair
Two terms, two jobs.
- · Correction (Cl 10.2.1) deals with the product. Quarantine the failed cubes. Replace the defective rebar. Recall the unconfined element. Containment is immediate and physical.
- · Corrective action (Cl 10.2.2-10.2.4) deals with the process. Why did the cubes fail? Fix the production process. Retrain the QC team. Add a moisture-correction step. Update the SOP. Verify the next pour does not repeat.
A CAPA that records only the correction is half-complete. ISO 9001:2015 Cl 10.2 is unambiguous — both must happen, neither substitutes the other. An external auditor who finds correction without root cause will issue a Major finding.
NCR categorisation — Critical, Major, Minor
| Severity | Definition | Closure SLA | Root cause |
|---|---|---|---|
| Critical | Safety, structural integrity or regulatory breach. Pour may continue at risk. | 7 days | Mandatory (5-Why + fishbone) |
| Major | Repeat nonconformity, systemic defect or significant cost/schedule impact. | 14 days | Mandatory (5-Why minimum) |
| Minor | Isolated single incident with limited scope and contained consequence. | 30 days | Decision-based (record the decision if no RCA) |
Working SLAs — typical for Indian site QMSs; tighter on Critical (3 days for safety-critical NCR) is also common.
Worked example — low cube result, 5-Why
Scenario. M30 slab pour — 28-day cube set averages 26 MPa, below the fck − 3 individual floor of 27 MPa in IS 456 Table 11. NCR raised as Major.
5-Why walkthrough
Why 1: Cube average 26 MPa — concrete under-strength.
Why 2: Mix design was correct, batching plant records show correct proportions — but recorded water addition was 12 L/m³ above target.
Why 3: Slump at delivery averaged 175 mm vs target 100 mm; driver added water at site to recover workability after a 30-minute delay.
Why 4: No clear protocol defined who has authority to retemper or add water on site; dispatcher did not flag the delay to QC.
Why 5 (root): Site instruction SOP does not define retempering authority or slump-correction procedure; dispatcher and driver worked around the protocol because there was no protocol.
Corrective action. (a) Update SOP with explicit retempering authority — only QC engineer, only to max +10 mm, with re-test of cube. (b) Brief all drivers and dispatchers. (c) Add a slump-at-delivery check to the pour card. (d) Review all 7-day results from the same batch ticket group; schedule a follow-up pour to confirm.
Verification (Cl 10.2.4). 30-day follow-up: 12 pours, slump at delivery within target every time, no retempering events recorded. CAPA closed 35 days after NCR issue.
Common deviations seen on Indian sites
NCR closed with a paragraph saying "test re-done, OK now." No root cause, no action, no verification. Cl 10.2 auditor finding.
Root cause blaming an individual. Cl 10.2 looks at systemic cause — why did the system allow a careless action?
Action implemented but the next batch never re-checked. Cl 10.2.4 mandates verification — most-skipped sub-clause in construction audits.
Five cube failures, all closed with "retrained operator." Root cause: aggregate moisture probe broken for two months. Same root cause, no system change.
NCR issues with 7/14/30 day SLAs are routinely closed 2-3x late with "extension requested." Track extensions as a trend — same root as the original NCR.
One NCR raised and closed. Same root cause existed in 4 other pours that month but no scan performed. Cl 10.2.2(d) requires it explicitly.
Field-checklist blocks
A short questionnaire, an inspector's checklist, and three worked examples that show how a cube result becomes an NCR, a root cause and a closed CAPA under ISO 9001:2015 Cl 10.2.
Questionnaire — asked when the NCR is raised, before it is closed
- Which severity is this, and therefore which closure SLA applies? Critical closes in 7 days, Major in 14 days, Minor in 30 days, with 3 days often used for safety-critical NCRs.
- Has the correction been done and recorded separately from the corrective action? Cl 10.2.1 is the product: quarantine the failed cubes, recall the load, halt the pour. Cl 10.2.2 to 10.2.4 is the process: why it happened, what changed, and proof it did not happen again.
- What root cause method has been used, and does the severity allow a decision-based approach? 5-Why plus fishbone is mandatory for Critical, 5-Why at minimum for Major, and a documented decision for a Minor that has not recurred.
- Has the similar-NC scan been done, as Cl 10.2.2 requires? Were there other pours, batches or ticket groups in the same period with the same root cause?
- Does the root cause name a system rather than a person? "The operator was careless" is not a cause, and it will not survive an audit.
- Who has authority to retemper or add water on site, and what is the maximum permitted addition? If the answer is written down, the next driver can follow it. If not, the driver will find a way.
- How will effectiveness be verified, over what window and against what evidence? Cl 10.2.4 is the sub-clause most often skipped, and it is the one that decides whether the CAPA is actually closed.
- Has the QMS itself been updated, per Cl 10.2.5 and 10.2.6, so the same failure cannot be raised a second time through a document that was never amended?
Inspector's checklist — what to verify on site
- NCR raised with severity, SLA date and the nonconforming quantity identified, tied to the specific cube set or batch ticket, and the affected concrete quarantined under Cl 10.2.1.
- Root cause analysis attached and complete to the cause: 5-Why chain or fishbone, with the systemic cause stated in one line.
- Similar-NC scan recorded across other pours and batches in the period, with the outcome stated for each one, whether or not an NCR was raised.
- Corrective action implemented and communicated: the SOP amended, the briefing record, the pour card or dispatch sheet changed, and the calibration or equipment change made where that is the cause.
- Effectiveness check defined before closure, with the window, the quantity to be checked (for example the next 30 m³ or the next batch) and the acceptance written down in advance.
- Verification evidence attached at closure, not promised. A CAPA closed on the strength of the action being implemented is not a closed CAPA.
- QMS update evidenced: risk register entry, revised SOP, checklist or ITP with a new revision number, and the brief to management review.
- Closure date against SLA, with any extension justified in writing and the pattern of extensions tracked as a trend.
What happens if… three worked examples
What happens. For M30, fck = 30 N/mm² and the individual floor in IS 456 Table 11 is fck − 3 = 27 N/mm², so a set averaging 26 MPa is 1 MPa below the floor. The NCR is raised as Major. The 5-Why walks past the concrete and past the batching: recorded water addition was 12 L/m³ above target, slump at delivery averaged 175 mm against a 100 mm target because a driver added water after a 30-minute delay, there was no protocol defining who could retemper, and the root cause is the missing SOP clause rather than the driver.
Likely outcome. The correction is immediate and physical: quarantine the affected cubes, recall the load, halt the pour. The corrective action is the SOP, which now names the QC engineer as the only person who may retemper, caps it at +10 mm, and requires a cube re-test. The closure date is the problem. A Major has a 14-day SLA, the verification window ran 30 days, and the CAPA was closed 35 days after the NCR was issued, so it went 21 days past its SLA on the strength of a verification window that was itself longer than the SLA. Plan the verification window inside the SLA, or request the extension on day one rather than on day 30.
What happens. Five separate NCRs are raised and each one is closed with the same line about retraining. The common cause sits in plain sight: the aggregate moisture probe had been broken for two months. Nobody scanned, so each failure was treated as a person failing on a different day.
Likely outcome. The retraining changed nothing, because nothing about the system changed. Cl 10.2.2 requires the cause to be determined and requires the check for similar occurrences, and the scan would have found the same root cause in 4 other pours that month. One root cause, not five, and the fix is the probe plus the procedure that tests it, not a fifth round of briefing. Where an NCR repeats on the same cause, the repeat itself is the finding: a system that lets the same failure through again is the Major NC.
What happens. The nonconforming product is dealt with, the test is repeated and the repeat passes, and the NCR goes into the register as closed. There is no cause, no action and no verification.
Likely outcome. An external auditor who finds correction without root cause will raise a Major finding, and the closure you already signed becomes evidence against you. The three parts have to be present and separate: correction under Cl 10.2.1, cause and action under Cl 10.2.2 and 10.2.3, and verification of effectiveness under Cl 10.2.4 against a defined window, typically 7 to 30 days. A CAPA that records only the correction is half-complete, and the half that is missing is the half that stops the next batch.
Frequently Asked Questions
What is the difference between correction and corrective action under ISO 9001 Cl 10.2?
What is the typical NCR closure timeline in construction QMS?
Does every NCR need a root cause analysis?
Related articles
Ishikawa Fishbone & 5-Why — Root Cause
The two root-cause analysis tools Cl 10.2 calls for.
QA/QC Systems — ITPs, Hold-points & CAPA
Where the ITP intersects the CAPA loop on a project.
Cube Testing — IS 516
The product side: where low cubes become Cl 10.2 NCRs.
Acceptance Criteria — IS 456 Table 11
The acceptance threshold the CAPA loop is judged against.
Amit Haridas
Founder & Proprietor, ConcreteInfo. 25+ years experience in construction QA/QC, concrete technology, RMC plant operations, consulting and technical training across India. ISO Lead Auditor. For a CAPA-loop audit or low-cube investigation, contact amit@concreteinfo.in.
Technical updates, not sales emails
One email when a new article goes out on concrete technology, QA/QC and construction quality. No promotions, and your address is never sold or passed to advertising networks. Subscribing is separate from making an enquiry.