Root Cause Under Clause 10.2: How Deep Is Enough

A site manager once showed us a corrective action for a batch of mislabelled parts. The root cause recorded was “operator error.” The auditor had signed it off. Six months later, the same nonconformity appeared again.

That is the problem with shallow root cause analysis. It closes the paperwork without closing the problem.

What Clause 10.2 Actually Says

ISO 9001:2015 clause 10.2 requires you to review the nonconformity, determine the root cause or causes, consider whether similar nonconformities exist or could occur, implement corrective action, and then review the effectiveness of that action.

What it does not say is that you must use 5-Why, or fishbone, or any other specific method. It does not set a minimum depth. What it does require is that the corrective action is “appropriate to the effects of the nonconformities encountered.”

That phrase, appropriate to the effects, is doing most of the work.

Depth Is Proportionate to Risk

A scratched label on an internal document probably does not need a three-week investigation. A dimensional nonconformity on a safety-critical component almost certainly does.

The auditor’s question, whether internal or third-party, will usually be: is the corrective action likely to prevent recurrence? If you can answer yes and demonstrate why, the depth of your analysis is probably sufficient.

If your root cause is “operator error” and your corrective action is “operator retrained,” that is rarely sufficient. Not because it is wrong, exactly, but because it does not tell you why the operator made the error. Was the instruction unclear? Was the tooling ambiguous? Was there time pressure from a supervisor? Those are the conditions that will persist after the training record has been signed.

The “Why Would a Reasonable Person Do This?” Test

One practical test for root cause sufficiency is to ask: given the conditions at the time, why would a reasonable, competent person have done what they did?

If the answer is “because the drawing dimension was hard to read on the shop floor copy,” then that is the root cause. The corrective action is to fix the drawing format, not to retrain the operator.

If the answer is “because the procedure had not been updated after a process change six months ago,” then that is the root cause. Retraining the operator on an out-of-date procedure changes nothing.

This test pushes past individual blame and toward the system conditions that allowed the nonconformity to happen. That is what clause 10.2 is pointing at when it asks whether similar nonconformities could occur elsewhere.

When One Level Is Enough

Not every investigation needs to reach bedrock. If the root cause is clearly a one-off, traceable to a specific external event, and genuinely unlikely to recur, then a brief analysis with a targeted correction may well be appropriate to the effects.

A supplier sent a single batch of undersized fasteners due to a calibration fault they have since corrected and evidenced. Your corrective action is to tighten incoming inspection for that supplier for the next six months. That is a proportionate response. You do not need to redesign your entire incoming quality process.

The test is still the same: is this action likely to prevent recurrence? If yes, and the risk is low, a shallow analysis is defensible.

What Auditors Are Actually Looking For

In a third-party audit, the auditor is not checking whether you used the right tool. They are checking whether you understood the problem. A well-written corrective action that explains the conditions, the contributing factors, and the specific change made, in plain language, will usually satisfy a competent auditor more readily than a five-page fishbone that ends in “improve operator awareness.”

Your objective evidence should show:

• What the nonconformity was
• What you found when you investigated
• What systemic condition allowed it to happen
• What you changed
• How you checked that the change worked

That last point is often missing. Effectiveness review does not have to be elaborate, but it does have to happen. An unclosed corrective action where the effectiveness review box says “N/A” is a finding waiting to happen.

Closing the Loop Without Overcooking It

Root cause analysis under clause 10.2 is not an academic exercise. The goal is to change something real, so that the same nonconformity does not reappear. The depth should match the risk.

If you are finding that your corrective actions keep coming back, or that your investigations consistently stop at the operator level, it is worth asking whether your diagnostics process is helping or just generating paperwork. The diagnostics tools on this site are designed to work at shop floor pace, not audit pace.

And if repeat nonconformities keep clustering around the same parts of the process, that is often a sign of something deeper, whether in workplace organisation, production flow, or how losses are being recorded day to day. A quick review at losses.cadencestandard.com can show you where the pattern sits before you commit to a full investigation.