Nonconformity & CAPA

When something falls short — a failed control, an audit finding, an incident follow-up — Clause 10 asks you to correct it, understand why it happened, and confirm the fix actually worked. The Nonconformities module walks that full loop. It’s shared by ISO 27001 and ISO 9001.

Log a nonconformity

Create a record with a title, description, source (audit, incident, risk, control gap, or manual), severity (observation, minor, or major), an owner, a due date, and an optional source reference. Audit findings and security incidents can also raise nonconformities automatically, so the register becomes the single hub for everything that needs correcting.

Work the lifecycle

Each nonconformity moves forward through a guided lifecycle:

Open → Root cause → Corrective action → Verifying → Closed

• Root-cause analysis — pick a method (5 Whys or Fishbone) and capture the root cause.
• Corrective actions — add actions typed as Correction (containment), Corrective (removes the root cause), or Preventive, each with an owner, a due date, and a done toggle.
• Effectiveness & closure — schedule a verification date (Keel flags it when it comes due), record how you confirmed the fix held, and tick “I confirm the corrective action is effective.”

A nonconformity cannot be closed until effectiveness is verified — the Clause 10 gate that stops “we did something” from being mistaken for “it worked.” Closed records can be reopened.

The list view tracks Open, In progress, Verifying, Closed, plus Overdue and Verification due counts so nothing stalls.

Optional 8D report

For significant or recurring problems you can turn on a structured 8D report (disciplines D1–D8: team, problem description, interim containment, root cause, permanent corrective actions, implement & validate, prevent recurrence, closure). It’s optional and complements the fields above.

Tip

Set a verification date a few weeks after the action is done, not on the same day. Effectiveness means the problem stayed fixed — Keel will surface the record again when the check comes due.

Next steps

• Internal audits: findings that promote into this register.
• Tasks: give corrective-action work an owner and a due date.
• Risk register: recurring nonconformities often point to a risk worth re-rating.