Nonconformities must be identified and managed, their causes addressed where needed, and the action scaled to the impact and checked for effectiveness.
What applies today
The body must have procedures to identify and manage nonconformities in its operations. Where necessary it must act to remove the causes so that the problem does not recur. The action must be in proportion to the harm the problem can do. The procedure must define how the body identifies nonconformities, for example from complaints and internal audits; determines their causes; corrects them; evaluates whether action is needed to prevent recurrence; decides and implements the action in good time; records the results; and reviews the effectiveness of the action.
Why it matters
Corrective action is the difference between fixing a symptom and changing the system. The clause does not require a root cause analysis for every small issue, but it does require a judgement about recurrence and impact. The effectiveness review is the step most often missing: the action is recorded as complete on the day it is implemented, before anyone knows whether it worked.
The public FDIS contents lists clause 8.7 as Corrective actions (Option A). This site uses the shorter label Corrective actions for the page. The FDIS requirement wording is not held, so the requirement above is the 2012 text that applies until publication.
Where this clause lands in the revision
Clause 8 is where the 8.8 replacement meets management review, internal audit and corrective action. The public record confirms the titles; the requirement wording is not held. A first artefact an assessor commonly asks for here is corrective action procedure covering the seven steps. The party this touches first is The improvement owner and every manager who receives a nonconformity.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Procedure | Corrective action procedure covering the seven steps |
| Log | Nonconformities with cause, action, owner and due date |
| Effectiveness | Evidence that the action was checked after implementation |
| Impact | Record showing the action was scaled to the impact |
One common question. pick a repeated nonconformity and ask why the first corrective action did not work. A log that closes actions on the day they are created invites that question.
Common failures
- Every issue gets the same short form and no cause analysis
- Actions are closed when the form is signed
- The same finding appears in three audits with three separate fixes
Prepare before publication
Find the three most repeated findings in the last two years. Review whether the actions addressed the cause or only the instance.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 8.7 has no separate date.
Cross-references
7.13 Complaints and appeals · 8.5 Management review · 8.6 Internal audits · 8.8 Actions to address risks and opportunities (FDIS change)
Source
Source for 8.7: ISO/IEC 17065:2012, Clause 8.7, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.