ISO Audit Group / After

Root cause analysis that is not a formality

Most corrective actions address the instance.

Corrective action is supposed to address the cause so the problem does not recur. In practice most responses fix the specific record, add a check, and retrain the individual, which addresses the instance and leaves the cause operating.

The tell is recurrence. A finding that appears again in the next cycle, in a different area, was never addressed at cause, and repeated findings across cycles are the strongest available evidence that the corrective action process is ceremonial.

Useful analysis asks why the system permitted it rather than why the person did it. If a step can be omitted without anything detecting the omission, the cause is the absence of detection rather than the omission.

Retraining as a corrective action deserves particular scepticism. It is appropriate where the cause was genuinely a knowledge gap and is otherwise a way of locating a system problem in an individual.

The verification of effectiveness, later, is the step most often skipped. Closing an action when the fix is implemented is not the same as confirming it worked, and the standards ask for the second.

The other corrective action failure is scope. A finding at one site addressed only at that site, where the same process runs at four, has treated a system problem as a local one, and the extension question should be asked explicitly on every finding.