Nonconformities are inevitable in any management system — what matters is how your organization responds. Clause 10.2 of ISO 14001:2015 establishes a structured five-step process for reacting to nonconformities, identifying root causes, implementing corrective actions, and verifying effectiveness. The 2015 revision embedded former “preventive action” requirements into risk-based thinking (Clause 6.1), making the corrective action process focused on eliminating causes of actual problems.
What Is a Nonconformity?
A nonconformity is any deviation from the requirements of ISO 14001:2015 or the organization’s own EMS. Sources include internal audits, external audits, monitoring data showing exceedances, compliance evaluation findings, incident investigations, stakeholder complaints, and management review findings.
Minor vs. Major Nonconformities
Minor: An isolated lapse or deviation from a specific requirement that does not indicate a systemic breakdown. Examples include a missed document review date or incomplete training record.
Major: A total absence or complete breakdown of a system element, or a pattern of minor nonconformities indicating systemic failure. Examples include no environmental aspects register, failure to conduct management review, or ongoing regulatory noncompliance.
The Five-Step Corrective Action Process
- React: Control and correct the nonconformity immediately. Deal with consequences, including mitigating adverse environmental impacts (e.g., containing a spill, stopping a discharge)
- Evaluate: Review the nonconformity, determine root causes, and determine if similar nonconformities exist or could potentially occur elsewhere. Auditors specifically verify this step
- Implement: Take corrective actions proportionate to the significance of the effects, including environmental impacts
- Review effectiveness: Verify that corrective actions have eliminated the root cause and the nonconformity has not recurred
- Make EMS changes: Update the EMS if necessary — this may include revising procedures, modifying operational controls, or updating the risk assessment
Correction vs. Corrective Action
Correction addresses the immediate problem (containing a spill, stopping a process, cleaning up a release). Corrective action eliminates root causes to prevent recurrence (installing secondary containment, changing procedures, retraining personnel). Both are required — correction first for immediate response, then systematic investigation and permanent fixes.
Root Cause Analysis Methods
While no specific methodology is prescribed, widely accepted tools include:
- 5 Whys: Iteratively asking “why” to drill down from symptoms to root causes
- Fishbone (Ishikawa) Diagram: Categorizing potential causes by people, processes, equipment, materials, environment, and management
- FMEA: Failure Mode and Effects Analysis for systematic risk evaluation
- Pareto Analysis: Identifying the vital few causes responsible for the majority of problems
Documentation Requirements
The standard requires retaining documented information of the nature of nonconformities and subsequent actions taken, and the results of corrective actions. Organizations typically maintain a Nonconformance Register or Corrective Action Report (CAR) capturing the description, root cause findings, immediate correction, corrective action plan, responsibilities, timelines, and effectiveness verification.
Common Pitfalls
- Addressing symptoms without investigating root causes
- Not checking whether similar nonconformities exist elsewhere
- Corrective actions disproportionate to the environmental impact
- Failing to verify effectiveness after implementation
- Incomplete documentation that cannot demonstrate the full process to auditors
Frequently Asked Questions
What does ISO 14001 clause 10.2 require?
Clause 10.2 requires that when a nonconformity occurs, the organization reacts to it, takes action to control and correct it, and deals with the consequences. It must then evaluate whether action is needed to eliminate the root cause so the nonconformity does not recur, implement any action needed, review its effectiveness, and make changes to the EMS if required. Documented information must be retained on both the nonconformity and the results of any action taken.
What is the definition of a nonconformity in ISO 14001:2015?
A nonconformity is the non-fulfilment of a requirement. In practice that means any failure to meet a requirement of the standard, a requirement of your own EMS, or a compliance obligation you have committed to. It covers missed inspections, untrained personnel performing controlled tasks, exceeded permit limits, missing records, and procedures that exist on paper but are not followed in the field.
What is the difference between a correction and a corrective action?
A correction fixes the immediate problem. A corrective action removes the underlying cause so the problem does not happen again. Cleaning up a spill is a correction; replacing the failed valve design and revising the inspection frequency that missed it is corrective action. Auditors frequently raise findings where organizations have documented only the correction and stopped there.
What is the difference between a major and a minor nonconformity?
A major nonconformity is a total breakdown of a required part of the EMS, a failure that poses significant environmental or regulatory risk, or a pattern of minor findings showing a systemic gap. A minor nonconformity is an isolated lapse in an otherwise functioning process. Majors typically must be closed before certification is granted or maintained; minors are usually addressed on an agreed timeline.
How long do you have to close an ISO 14001 nonconformity?
ISO 14001 sets no fixed deadline. The standard requires action to be timely and appropriate to the significance of the effects. Most certification bodies expect a corrective action plan within 30 days of a finding and evidence of closure within 60 to 90 days, with major nonconformities on a shorter clock. Your own EMS procedure should define the timeframes you will be audited against.
Does every nonconformity require a root cause analysis?
No. Clause 10.2 requires you to evaluate whether action is needed to eliminate the cause, which means the depth of analysis should match the significance of the nonconformity. A minor administrative slip may need only a brief justification for why no further action is warranted. Recurring findings, permit exceedances, and anything with real environmental consequence warrant a structured method such as 5 Whys or a fishbone analysis.
Ecesis runs the full clause 10.2 workflow, from correction through root cause to verified effectiveness.
Request a free 30-minute demo
