Corrective action removes the cause of a nonconformity that has already happened, so it does not happen again. Preventive action removes the cause of a potential nonconformity, so it never happens in the first place. The trigger is the difference: a corrective action starts from a real defect, complaint or audit finding; a preventive action starts from a trend, a risk or a near miss. Neither is the same as a correction, which only fixes the bad part in front of you. ISO 9001:2015 folds preventive action into risk-based thinking, while ISO 13485 still requires both as separate processes.
| Correction | Corrective action | Preventive action | |
|---|---|---|---|
| Trigger | A nonconforming item found now | A nonconformity that has occurred | A potential nonconformity: a trend, risk or near miss |
| Target | The affected product | The root cause of the actual problem | The cause of a problem that has not happened yet |
| Question | What do we do with these parts? | Why did this happen, and how do we stop it recurring? | What could go wrong here, and how do we stop it occurring? |
| Typical actions | Rework, sort, scrap, use-as-is with approval | Change the process, add error-proofing, revise the procedure | Update the PFMEA, add a control before failure, extend a fix to similar lines |
| Proof it worked | The affected parts conform or are dispositioned | The problem does not recur over a defined period | The leading indicator stays in control; no first occurrence |
| ISO 9001:2015 | Clause 10.2 (react to the nonconformity) | Clause 10.2 | No separate clause; handled through risk-based thinking in 6.1 |
| ISO 13485:2016 | Control of nonconforming product | Its own requirement (8.5.2) | Its own requirement (8.5.3) |
Most shops record all three on a single CAPA form, which is fine as long as each box is used for the right job. Containment and correction deal with the parts. Corrective action deals with the cause. Preventive action looks sideways: where else could the same cause hit, and what risks are building up that have not caused a defect yet?
The common failure is a form where “corrective action” says “reworked 40 parts, retrained operator”. The rework is a correction. Retraining is rarely a root-cause fix unless the investigation showed the operator lacked a skill the process depends on. The root cause analysis and CAPA guide, the pillar for this cluster, covers how to prove a cause before choosing the action.
ISO 9001:2008 had a preventive action clause. The 2015 edition removed it and put risk-based thinking throughout the standard instead: you plan actions to address risks and opportunities (clause 6.1), and the standard notes that one purpose of the system is to act as a preventive tool. So an ISO 9001 auditor will not look for a preventive action procedure, but will look for evidence that you identify risks and act on them, for example in a risk register, a PFMEA or management review.
ISO 13485:2016 and many medical device regulations kept preventive action as a named process. If you hold both certificates, keep a preventive action path in the CAPA procedure and use it for the ISO 9001 risk evidence too. ISO 9001 vs ISO 13485 covers the other differences.
Preventive actions come from data that shows risk before it shows defects:
When an issue lands on your desk, three questions sort it quickly. First, has a nonconformity actually occurred? If a part, process, record or delivery failed a requirement, the work on its cause is corrective action. If nothing has failed yet but the data shows it could, the work is preventive. Second, what are you acting on? Acting on the product is correction; acting on the cause is corrective or preventive action. Third, how will you prove success? A corrective action is proven when the problem stops recurring. A preventive action is proven when the leading indicator, such as a trend, a risk rating or a near-miss count, stays where you want it.
Audit findings follow the same rule. A nonconformity found by an auditor needs correction and corrective action. An observation or opportunity for improvement is closer to preventive action: nothing failed, but a risk was seen. Writing the right label on the record keeps the CAPA log honest and makes trend reports meaningful, because a log full of mislabeled actions cannot tell you whether the system is getting better.
Example: A fictional stamping cell: one corrective action and one preventive action
Result: Example result: the corrective action stops the defect on press 3; the preventive action stops the same cause from reaching presses 2 and 4. All numbers are example values.
Not as a separate clause. ISO 9001:2015 expects you to address risks and opportunities, which covers the same ground. ISO 13485 and many regulators still require a preventive action process by name.
A correction acts on the nonconforming product, for example rework or scrap. A corrective action acts on the cause so the nonconformity does not recur.
Yes. A CAPA often holds a corrective action for the line where the problem happened and preventive actions for similar lines that share the cause.
Your CAPA procedure should define the criteria, usually severity, recurrence, customer impact and risk. The quality team typically screens issues against them.
Long enough to see the problem if it were still there. Base it on how often the problem used to occur: if it showed up once a month, watch for at least three months.
New templates, charts and calculators for quality and manufacturing engineers, when they ship.
COPLAIN AI PLATFORM
Coplain updates the work instruction when a corrective action changes the process, so the fix reaches the floor instead of staying in the CAPA file.
Generate yours automatically with Coplain →Related Tools & Templates