How to write a corrective action report

What a corrective action report (CAR) must contain

ISO 9001 clause 10.2 requires you to:

1. React to the nonconformity
2. Evaluate the need for action to eliminate the cause
3. Implement the action
4. Review effectiveness
5. Update risks and opportunities if needed
6. Make changes to the QMS if needed

A good CAR documents all six steps on a single page.

The 8-section template

1. CAR number and date raised
2. Source — internal audit, customer complaint, supplier issue, external audit, etc.
3. Nonconformity description — what happened, where, when, who detected it. Reference the clause/SOP that was breached.
4. Immediate containment — what you did to stop the bleeding (quarantine product, notify customer, etc.)
5. Root cause analysis — use 5 Whys or a fishbone. Stop when you reach a systemic cause, not a person.
6. Corrective action — what you will change so it does not happen again. Owner. Due date.
7. Verification of implementation — evidence the action was completed (signed-off SOP, training records, etc.)
8. Verification of effectiveness — evidence the problem has not recurred over a defined period (e.g., 3 months, 50 transactions). This is the step most companies skip.

Root cause done right

Bad: "Operator made a mistake." Good: "Operator was not trained on the revised SOP because the training matrix was not updated when the SOP was revised in March."

Always ask: "Why did our system allow this?"

Common audit findings on CAPA

• Root cause stops at "human error"
• Corrective action is just the containment action
• No verification of effectiveness
• CAPAs sit open for 6+ months with no escalation
• No trend analysis across CAPAs

Make it a habit

Review open CAPAs in your monthly ops meeting. Trend the categories quarterly. The CAPA log is the single best indicator of how mature your QMS really is.