A nonconformity in an ISO audit is rarely the real problem. It is the symptom. If you only fix the symptom, the same finding comes back at the next surveillance audit, usually with a harder grade attached.
Root cause analysis for ISO audits is how you stop that cycle. It gives you a structured way to find out why a finding happened, so your corrective action removes the cause instead of patching the result. This guide covers what auditors expect, a step-by-step process, worked examples of the 5 Whys and fishbone diagram methods, and the mistakes that cause corrective actions to be rejected.
Key takeaways
- Root cause analysis (RCA) finds why a nonconformity happened, not just what
- ISO management system standards, including ISO 9001, ISO 45001 and ISO 22000, require you to determine the cause and take corrective action to eliminate it.
- The 5 Whys suits simple, linear problems. A fishbone diagram suits problems with several possible causes.
- “Human error” and “lack of training” are rarely true root causes. Keep asking why.
- A corrective action is only complete once you have checked that it worked.
What is root cause analysis in an ISO audit?
Root Cause Analysis for ISO Audits is a systematic approach used to identify the underlying cause of a nonconformity, audit finding, or problem. It helps organizations determine why an issue occurred, implement effective corrective actions, prevent recurrence, and support continual improvement and compliance with ISO requirements.
In an audit setting, the problem is a nonconformity: a requirement that was not fulfilled. If you need a refresher on how findings are raised and classified, read our guides on what a nonconformity is in ISO audits and major vs minor nonconformities. This article picks up where they end: you have a finding, so what do you do next?
What the standards require?
The main management system standards share the same structure. In each, the clause on nonconformity and corrective action is clause 10.2 (in the 2015/2018 editions):
- ISO 9001:2015: when a nonconformity occurs, react to it, evaluate whether action is needed to eliminate the cause, implement that action, review its effectiveness, and update risks and opportunities if necessary.
- ISO 45001:2018: the same logic applies to incidents and nonconformities, including investigating the cause of an incident.
- ISO 22000:2018: the same pattern applies to food safety nonconformities.
The standards do not name a specific RCA method. What they require is evidence that you analysed the cause and that your action matched it. If you are preparing for the 2026 revision of ISO 9001, check the clause numbering in the new edition during your transition. Our guide to what changed in ISO 9001:2026 covers the main updates.
Correction vs corrective action vs root cause
These three terms are often mixed up, and mixing them up is one of the quickest ways to get a corrective action sent back.
| Term | What it means | Example (calibration certificate missing) |
| Correction | Fixing the immediate problem | Get the instrument calibrated now |
| Root cause | The underlying reason it happened | No one owns the calibration schedule, and the tracker has no reminders |
| Corrective action | Action that removes the root cause | Assign an owner, add automated reminders, review the schedule monthly |
A correction deals with this instance. A corrective action prevents the next one.
Step-by-step root cause analysis process
- Understand the finding. Read the nonconformity statement carefully. Confirm the requirement, the evidence and the scope. If the statement is unclear, ask the auditor before you analyse.
- Contain the problem. Apply an immediate correction to limit harm: quarantine product, stop the activity, fix the record.
- Check the extent. Look for the same issue elsewhere: other shifts, sites, products or departments.
- Gather facts and evidence. Review records, interview the people involved, and look at the process as it actually runs, not as it is written.
- Analyse the cause. Use a method that fits the problem (see below). Involve the people who do the work.
- Define and implement corrective action. Address the root cause. Assign an owner, a deadline and resources.
- Verify effectiveness. After a set period, check the evidence that the problem has not recurred. Record the result.
Method 1: The 5 Whys
The 5 Whys works by asking “why?” repeatedly until you reach a cause that you can control and fix. “Five” is a guide. Sometimes three questions are enough, and sometimes it takes more.
Worked example (ISO 9001)
Finding: Calibration of a measuring instrument was overdue by two months.
- Why was it overdue? The calibration was not scheduled.
- Why was it not scheduled? It was not on the calibration register.
- Why was it not on the register? The instrument was bought last year and never added.
- Why was it never added? The purchasing process has no step that tells the quality team about new measuring equipment.
- Why is there no such step? The procedure was written before the company started buying this equipment directly.
Root cause: The purchasing procedure does not trigger registration of new measuring equipment.
Corrective action: Add a registration step to the purchasing procedure, train purchasing staff, and review all current instruments against the register.
When to use it: simple problems with one likely chain of causes, or as a quick check inside a bigger analysis.
Watch out for: stopping at a person (“the technician forgot”) instead of a process, and following only one chain when several exist.
Method 2: The fishbone (Ishikawa) diagram
A fishbone diagram maps every possible cause of a problem, sorted into categories. It is useful when the cause is not obvious. You write the problem at the “head,” then draw category “bones” and add causes to each.
Common categories (often called the 6Ms in manufacturing):
- Manpower/People: skills, supervision, workload
- Method: procedures, instructions, process design
- Machine: equipment, maintenance, tools
- Material: supplier quality, storage, specifications
- Measurement: inspection, calibration, data accuracy
- Environment: conditions, layout, communication
You can adapt the categories. Service organisations often use People, Process, Policy, Place and Technology.
Worked example (ISO 45001)
Finding: Workers on a construction site were found working at height without correctly fastened harnesses.
- People: new workers did not fully understand anchor point use; supervisor covering two zones
- Method: the work-at-height procedure does not specify anchor point checks before starting
- Machine/Equipment: harness sizes limited, so some workers wore ill-fitting equipment
- Environment: anchor points hard to reach in the area being worked
- Measurement: safety inspections check that harnesses are worn, not that they are fastened correctly
After discussion and evidence checks, the team prioritised two likely root causes: the procedure’s missing check and the limited harness sizes. They then used a 5 Whys on each to confirm and refine them.
For a ready-to-use tool for audits in this area, see our ISO 45001 safety audit checklist.
When to use it: complex or recurring problems, and any finding where several departments are involved.
Other tools worth knowing
| Tool | Best for |
| Pareto analysis | Finding which few causes account for most of the problems, using data |
| Fault tree analysis | Tracing how combinations of failures lead to a serious event |
| 8D problem solving | Customer complaints and recurring product issues needing a formal team report |
| FMEA | Looking ahead to prevent failures before they happen |
| Brainstorming with evidence checks | Quick team sessions, as long as ideas are tested against facts |
Avoid using one tool for every problem. Choose the tool that matches the complexity.
How to write a good root cause statement?
A good statement is specific, linked to a process, and supported by evidence. It should explain why the failure happened, and it should point to something you can change.
| Weak | Stronger |
| Human error | The data entry screen accepts blank fields, so operators can skip the batch number |
| Lack of training | The induction does not cover the new labelling requirement, and no one checks competence afterwards |
| Staff did not follow the procedure | The procedure is a 14-page document kept in the office, not at the workstation |
| Supplier problem | Incoming inspection does not check the specification that failed |
Common RCA mistakes that get corrective actions rejected
- Stopping at “human error.” Ask why the process allowed the error.
- Blaming training by default. If training were the cause, ask why it was missing, ineffective or never verified.
- Assuming one cause. Many findings have several contributing causes.
- Skipping evidence. A cause with no records or observations behind it is a guess.
- Confusing correction with corrective action. Fixing the instance is not enough.
- Corrective actions that are too vague. “Remind staff” is not an action plan. State who, what and by when.
- No effectiveness check. Closing the finding without proof it worked is a common reason for repeat findings.
- Analysing alone. The people who do the work usually know where the process breaks.
How auditors review your root cause analysis
When an auditor reviews your response, they typically ask:
- Does the analysis match the finding and its scope?
- Is there evidence behind the stated cause?
- Does the corrective action address that cause, not only the symptom?
- Were similar situations checked?
- Is there a clear owner and timeline?
- Was effectiveness verified afterwards?
If you can answer all six with records, you are in a strong position. Our article on the most common ISO 9001 audit findings shows the kinds of issues that most often need a proper root cause analysis.
Root cause analysis template
You can copy this structure into your corrective action request form:
| Finding reference and description | |
| Requirement not met (clause/procedure) | |
| Date raised / due date | |
| Immediate correction and date completed | |
| Extent check (where else could this occur?) | |
| RCA method used and participants | |
| Evidence reviewed | |
| Root cause statement | |
| Corrective action(s), owner, deadline | |
| Effectiveness check (method, date, result) | |
| Approval and closure |
Build this skill in your team
Strong root cause analysis is a core auditor skill, and it also helps process owners respond to findings with confidence. Verger Academy’s ISO 9001 Internal Auditor training and Lead Auditor training cover nonconformity reporting and corrective action evaluation.
If you are not sure which course fits your role, read our comparison of internal auditor vs lead auditor certification. You can also explore our ISO 45001 and ISO 22000 training pages.
Frequently asked questions
Is root cause analysis mandatory in ISO 9001?
ISO 9001 requires organizations to evaluate the need for action to eliminate the cause of a nonconformity and prevent its recurrence. While Root Cause Analysis for ISO Audits is not required as a specific tool or formal process for every minor issue, organizations should determine the appropriate level of analysis based on the significance, impact, and risk of the finding. The depth of the root cause analysis should therefore be proportionate to the nature and severity of the nonconformity.
Which ISO clause covers root cause analysis?
In ISO 9001:2015, ISO 45001:2018 and ISO 22000:2018 it sits within clause 10.2, on nonconformity and corrective action. Check the numbering in newer editions as you transition.
What is the difference between 5 Whys and a fishbone diagram?
The 5 Whys follows one chain of causes by asking “why” repeatedly. A fishbone diagram lays out many possible causes across categories. They work well together: use the fishbone to explore, then the 5 Whys to drill into the likely causes.
How many “whys” do I need to ask?
There is no fixed number. Stop when you reach a cause that sits in your process or system, that you can change, and that would prevent the problem if removed.
Can “human error” be a root cause?
Rarely. Human error usually points to a process weakness: unclear instructions, poor design, missing controls or inadequate training. Ask what allowed the error to happen.
How long should I take to complete a root cause analysis?
Follow the deadline given by your certification body or your internal procedure. Plan the analysis early so there is time to gather evidence and involve the right people.
What is the difference between corrective and preventive action?
Corrective action deals with a problem that has already occurred. Preventive thinking in the current standards is built into risk-based thinking: identifying and addressing potential problems before they happen.
Conclusion
Root Cause Analysis for ISO Audits turns an audit finding from a one-time fix into a lasting improvement. Define the problem clearly, gather objective evidence, select the right root cause analysis tool, identify the underlying cause, write a precise root cause statement, and verify that the corrective action was effective. By applying Root Cause Analysis for ISO Audits consistently, organizations can prevent recurrence, improve processes, and make repeat audit findings less likely.
