All ISO-based standards require defined steps to rectify nonconformances, including the following:
- Containment, interim actions and related activities necessary for control of nonconforming outputs
- Root cause analysis, methodology used, analysis and results
- Implementation of systemic corrective actions, including consideration of the impact on similar processes and products
- Verification of the effectiveness of implemented corrective actions
- Reviewing and, where necessary, updating the appropriate documented information (e.g. PFMEA, control plan, work instructions, procedures, etc.)
Definitions
Here are some important definitions:
- Correction: defined as “Action to eliminate a detected nonconformity”
- Corrective Action: defined as “Action to eliminate the systemic cause of a detected nonconformity”
Root Cause
Root cause analysis is a logic-based methodology to determine what, how and why an event or failure happened.
Effective root cause should:
- Identify the specific underlying situations or events
- Something(s) that can be reasonably identified
- Be fixable by Top Management
- Identify something that can be prevented at a systemic level.
Nonconformance Statements
When we write a nonconformance, identifying the process that failed within the system helps drive efforts towards systemic analysis and actions.
If the nonconformance isn’t geared towards the process, corrective actions may not be systemic in nature.
Clear nonconformance statements are the first step.
Citing the specific evidence found during the audit doesn’t typically belong in the nonconformance statement; list that under the evidence.
Three Distinct Parts of an NC
Let’s look at a couple of examples to show the three distinct parts of a nonconformance:
- Nonconformance Statement
- Requirement
- Evidence
Here are some Nonconformance Statement examples that could be reworded:
Example 1: Work instructions #48A, #56C and #93F are all missing information.
Better: The process to maintain work instructions is not effective.
Example 2: Preventive maintenance records are missing for Machine #582.
Better: The maintenance process is not entirely effective.
Example 3: The control plan and router for PN 23-5901485 have different inspection frequencies for measuring O.D. grind.
Better: The quality planning process is not effective in all areas.
Nonconformance Statement: The maintenance process is not entirely effective.
Requirement: IATF 8.5.1.5, The organization shall develop, implement and maintain a documented total production maintenance system. At a minimum, the system shall include the following…h) use of preventive maintenance methods.
Evidence: Preventive maintenance records are missing for Machine #582.
Nonconformance Statement: The quality planning process is not effective in all areas.
Requirement: ISO 9001, 8.5.1c: The organization shall implement production and service under controlled conditions. Controlled conditions shall include, as applicable: c) the implementation of monitoring and measurement activities and appropriate states to verify that criteria for control of processes or outputs… have been met.
Evidence: The control plan and router for PN 23-5901485 have different inspection frequencies for O.D. grind.
Process
Amtivo does not dictate what methodology our customers use; we do however, require them to submit the results of their analysis along with the finalized root cause(s).
This should be submitted along with the completed F-3000 NCR form, or their own corrective action form that contains the same information.
F-3000 Nonconformance Report
Customers may utilize their own corrective action format, as long as it contains all four required fields on page 2 of the ASR form F-3000:
- Correction
- Root cause analysis
- Corrective action
- Verification
It’s helpful if they reference their form on our F-3000.
Corrective action submissions for all audits (except Stage 1) against all standards must include the following:
- F-3000 Nonconformance Report, or the customers equivalent
- Evidence of correction
- Root cause methodology and results, with a final root cause statement
- Corrective action plan that addresses the identified root cause
- Effectiveness verification showing the root cause has been eliminated or mitigated
Let’s review each of these items in more detail.
Correction
Consider correction the “band-aid” or short term action to immediately fix what was identified.
Customers must submit evidence of correction when a nonconformance is issued.
- For example, if the auditor writes a nonconformance because there’s a vital step missing from a work instruction, the correction would be to update the work instruction.
- If the auditor identifies that there’s a mismatch between two documents, the customer would update both documents with the correct information.
Depending on the severity of the nonconformance, correction may also require the containment of product in-house, sorting / inspection, rework / repair and notification to the customer.
Root Cause Analysis
Many companies shine when determining the root cause for a defective part but struggle with performing it for a process.
Solid root cause analysis can be painful as the truth becomes apparent. No one wants to admit there was a failure in their system, or there was something they “forgot” as part of the planning process.
There are several methods available to help identify what went wrong, why it occurred and/or what allowed the situation to exist.
For all standards, ASR requires the customers to submit their root cause analysis, methodology and results (See F-3000 NCR Form).
Root Cause Analysis
This is the most important step in the corrective action process because when done properly, it identifies the gap in the system to prevent recurrence.
Root cause analysis and methodologies might include (but are not limited to):
- 5-Why
- Fishbone Diagram
- Is/Is Not
- Brainstorming
- Pareto chart
- Flowcharting
Root Cause Analysis should answer the questions “why,” “how” and “what”
- Why did / didn’t that happen?
- How did that happen?
- Why wasn’t it detected?
- What would stop it from happening again?
Going back to an earlier example of a work instruction missing a vital step, review the following examples of root cause and see which ones you think are valid.
Nonconformance Statement, written at the system level: The process to maintain work instructions is not effective in all areas.
Possible Root Causes:
- The work instruction didn’t contain all the steps.
- The employee responsible didn’t understand the requirements.
- The operators didn’t tell us it was wrong.
- The prior process engineer wrote it but he has since been fired.
- We forgot to include it.
Did you think any of these were valid? Did any of these statements address the failure at a systemic level?
The answer is no!
Let’s review each one with a bit more discussion.
1. The work instruction didn’t contain all the steps.
This is merely a restatement of the nonconformance statement.
2. The employee responsible didn’t understand the requirements.
This might be a starting point, but the next question should be “why” – why didn’t the employee understand the requirements? This may lead to additional questions related to training / training effectiveness, documentation of job responsibilities and definition of competency requirements.
3. The operators didn’t tell us it was wrong.
Blaming the employee is invalid 99.9% of the time, unless there is evidence of blatant disregard or deliberate tampering.
4. The prior process engineer wrote it but he has since been fired.
Blaming an individual doesn’t identify the systemic gap.
5. We forgot to include it.
On a very rare occasion, this might be a valid statement, but only if there is evidence that everything else was reviewed and rejected as a potential contributor to the situation.
Many customers us the 5-Why methodology to analyze potential gaps in a process.
This method starts with the nonconformance statement, then keeps asking “why” with each answer until the systemic failure is identified.
Let’s look at a few more examples of unacceptable root cause statements and additional questions that could be asked as starting points for a 5-Why:
The machine malfunctioned.
This doesn’t answer the question of “why” the equipment malfunctioned. What caused the machine to stop working correctly? Was it a preventable situation? Has the machine ever malfunctioned that way before? If so, why?
Our previous auditor didn’t find it.
Blaming the auditor for not identifying doesn’t answer the questions of “why” the situation existed!
It was done by a new employee
Was the employee trained? If not, that’s a good starting point: Why wasn’t the employee trained? If so, was that training verified as effective? If not, there’s another starting point: Why wasn’t the effectiveness of training verified?
Let’s look at a simple example of a 5-Why analysis for that nonconformance statement: The process to maintain work instructions is not effective in all areas.
Why? Posted work instruction is missing a critical step.
Why? Step was added to the process as a result of a continual improvement.
Why wasn’t the work instruction updated? The quality engineer implemented the change using an approved internal deviation. When the deviation expired, the work instruction was never updated to permanently implement the change.
Why wasn’t the work instruction updated? No formal requirement in the change control process to trigger a review for possible document updates from approved internal deviations.
Now we have a root cause that is actionable at the system level!
Corrective Action
The purpose of corrective action is to prevent recurrence by updating the system in some way.
It’s uncommon for the corrective action to be identical to the correction taken to fix the immediate issue.
In our work instruction example, we identified the following root cause: No formal requirement in the change control process to review for possible document updates from approved internal deviations.
This sounds like updates are required to their change control process.
This might include a procedure, process flow, checklist, turtle, work instructions, job responsibilities or other system-level documents to effectively implement that change.
When reviewing corrective action plans and evidence of implementation, be sure that the actions actually address the identified root cause.
For example, if the root cause states: “There is no formal process to validate tools” the corrective actions should include something about tool validation, e.g. a new or updated Buy-Off procedure, a change to the APQP process or Launch form, something like that.
Corrective Action Impact
The customer’s corrective action should include an assessment of similar parts and/or processes to ensure that the same symptom that was identified as part of the original nonconformance doesn’t exist elsewhere in the system.
Some people call this a “read–across”
Verification
Once the customer has implemented their systemic action plans, they need to verify the effectiveness of their actions.
This doesn’t mean verification that the actions were taken.
This means they have monitored the situation to determine that the actions they took have truly prevented recurrence.
This might involve a special internal audit, an update to their layered process audits or monitoring of data that demonstrates the system changes will prevent the situation from occurring again.
In some cases, the customer may realize their actions were not far reaching enough and revise their action plans.
Reviewing Corrective Actions
Once the customer has submitted their corrective actions, the auditor will evaluate the following:
- Is there evidence of correction? Was correction applied to similar situations?
- Does the root cause apply to the system and not just the specific evidence cited?
- Do action plans address the systemic root cause?
- Does the submitted evidence show an update to the system?
- Do the system updates consider similar parts or processes when applicable?
- Is there a solid verification plan for effectiveness and not just implementation?
If you cannot answer yes to all these questions, push back and ask for more information.
In Summary
By writing clear nonconformance statements supported by a documented requirement and objective evidence, we identify opportunities to strengthen their management systems.
When customers perform valid root cause analysis, they identify the systemic gap in their management system that allowed a nonconforming situation to exist. Performing corrective actions to close that gap will prevent a recurrence of that situation.
Verification ensures that the corrective action process is executed robustly.
