Corrective Actions (CA) process is a structured approach for implementing corrective measures to fix the nonconformity and actions to eliminate the root cause of the nonconformity (termed as remedial actions hereafter) using various techniques for root cause analysis.

Corrective Actions process applies to all type of nonconformities. Scope of nonconformity includes:

• Problems, defects, audit findings, customer complaints, and review findings reported at engagement level resulting from process as well as product reviews and validations
• Problems, defects, non-conformance, incidents reported at function/BU or Organization level
• Problems reported as an outcome of management review.

“Correction” is carried out as an immediate action to deal with the nonconformity or to reduce the impact of nonconformity that has occurred. “Remedial action”, on the other hand, is performed with the intent of eliminating the root cause of the nonconformity. Correction addresses the short-term need whereas remedial action is a long-term solution addressing the cause resulting into the nonconformity or undesired situation.

For example, fixing the security incident for unauthorized access by managing access permissions can be classified as correction. Identifying causes which result into security breach (such as faulty/inadequate server setting, lack of periodic check) and implementing the action which will eliminate the further occurrence of similar security breach will be treated as remedial action.

Output from the Corrective Actions process could be:

• Records of actions listed to deal with correction as well as remedial action.
• Record of root cause analysis like Pareto analysis, Cause-Effect diagram.
• Additional artifacts that may get generated from Corrective Actions includes records of Decision Analysis and Resolution (DAR) such as Pugh matrix and process improvement proposals.

Key elements of Corrective Actions process including corrections and remedial actions are discussed in detail in the sections below.

Corrections

When nonconformity occurs, it needs attention so as to fix it as well as reduce the further damage. Affected stakeholders are informed regarding the nonconformity and its immediate impact till the time fix is in place. Decision to fix the nonconformity depends on the various factors such as severity of nonconformity, its impact on the existing environment. Following steps need to be taken once nonconformity is identified:

• Include required stakeholders for assessing the impact of the nonconformity.
• Analyze the nonconformity details for its impact on the outcome, client relationship, schedule, compliance requirements.
• Assign severity depending on the extent of impact. High severity problems should be given immediate attention.
• Decide on the timeline to correct the nonconformity. While it is recommended to close the nonconformity within 1 week of reporting, severity and impact of the nonconformity to be considered for deciding the timeline.
• Assess potential risks and opportunities arising from the nonconformity captured and plan for mitigation.
• Fix the nonconformity as per agreed timeline.  
• Implement actions to control the undesired effect due to nonconformity as applicable.
• Escalate high severity problems which need immediate attention to required stakeholders or senior management.

Fix carried out for nonconformity needs to be documented for traceability and further analysis. For example defect logs are updated with the details of fix carried out, list of programs updated.

Remedial actions

Remedial actions are carried out to eliminate the root cause, to avoid the recurrence of nonconformity as well as prevent occurrence in other areas. To identify the exact root cause behind any nonconformity, a thorough analysis is required so that right set of actions can be identified. Use of proper techniques and involvement of right stakeholders will lead to an effective root cause analysis resulting into identification of actionable causes and possible actions to address them.

Conducting root cause analysis

The data comprising nonconformity details is taken as an input for analysis. Root cause analysis need not be conducted for all nonconformity records. It can be performed on a subset including high priority and high impact nonconformities. However it is important to decide and plan for the criteria to conduct root cause analysis. For example, all customer complaints need to be analyzed for its root cause. In case of defect data, defects classified with high priority or severity, critical functional defects are taken up for root cause analysis whereas cosmetic defects or low priority defects may not require detailed analysis.

Following steps are taken for carrying out effective root cause analysis:

• Include required stakeholders for assessing the impact
• Identify, analyze and prioritize nonconformity reported with reference to the following:
  • Frequency of occurrence
  • Impact on key success parameters
  • Source of problem
  • Type of problem/defect
  • Any other factor.
• Establish the list of possible causes of identified problems. For example, possible causes of identified defects in an engagement could be one or more of the following:
  • Inadequate skill level
  • Lack of training
  • Lack of documentation
  • Insufficient standards
  • Non adherence of standards
  • Inadequate inputs from Clients
  • Lack of communication
  • Oversight
  • Inappropriate methodology
  • Inadequacy of tools
    
• Use appropriate techniques for analysis. Quality control tools, such as cause-effect diagram, Pareto analysis, 5 Why and trend chart are simple yet effective techniques for causal analysis. Table given below lists down some of the useful techniques and purpose:

• Capture the root cause identified against the nonconformity. There could be one or more causes for the single nonconformity.
  

Identification and implementation of remedial actions

Once the root causes to nonconformity are identified, next step it to arrive at possible remedial actions for each of the root causes identified during causal analysis. For example, remedial actions could be improvement in current process, use of specific tool or technology or improvement in skill level. Choice of action depends on cost, complexity, and time tradeoff. In case there is any major change (process/tools/trainings/people) implement formal Decision Analysis technique (DAR) as it helps in more objective evaluation of actions suggested. Refer to DAR guidelines for additional details.

It is important to identify remedial actions in timely manner. Similarly, it is essential to close identified remedial actions in a stipulated timeframe to prevent reoccurrence of the nonconformity. Severity and priority of the nonconformance and its impact on the overall system and services, delivery schedule commitment to client and partners are some of the major factors to arrive at the timeline for closure. It is recommended to identify the remedial actions within 1 week from the day problem is reported and close the identified actions within 30 days.

It is important to communicate the actions to the affected groups. Document and track actions identified along with target date, responsibility and status. Update the status of implementation and capture details of corrective measures taken for further reference .

Monitoring effectiveness of remedial actions

Engagement Manager or Function Leads are responsible for the implementation and effectiveness of all remedial actions at the engagement level and at the function level respectively. If remedial actions are found to be ineffective, the causes of the same will be analyzed again.

Following steps are taken for evaluating and monitoring effectiveness of actions:

• Use internal audits, surveys, and/or informal reviews to monitor the effectiveness.
• Check if the nonconformity has been solved as well as there is significant reduction in nonconformity attributed to the same root cause.
• Determine the effectiveness of remedial action from the actions taken and the metrics/KPI tracked for the problem. For example, remedial actions taken based on unit testing defects could result into reduction of post-production defect density. Another alternate mechanism to track effectiveness could be through monitoring re-occurrence of similar problems.
• If the action taken is not yielding the desired results, conduct brainstorming sessions with the relevant stakeholders to identify the issues. Revisit the root cause analysis to validate if right root cause has been identified. Arrive at alternate action to rectify the problem.
• Evaluate if remedial actions identified can qualify for process improvements at BU/Region/ organization level. Process Improvement Proposal can be prepared and submitted to respective Quality teams in such cases.