Nonconformance and correction

A failed inspection check is an observation. A nonconformance records the failure the team will manage: its detection date, severity, description, inspection and current state. The link back to the inspection lets the Reviewer and Corrective Action Owner inspect the original control results while they work through containment and investigation. It also keeps several failures from one inspection distinguishable as separate work when needed.

Corrective work is a separate record linked to the nonconformance. It holds the owner, root cause, action, due date, completion date and status. The owner can describe what they will change, then record implementation. Effectiveness review asks whether the action actually addressed the linked failure. Closing the action should follow that review rather than merely the presence of a completed date.

• Failure record. The nonconformance describes what was found and how severe it is.
• Owned correction. The corrective action names a person and a due date for the response.
• Effectiveness check. Review occurs after implementation and before closure.

Agree when a failed check becomes a nonconformance and who assigns severity. A critical failure and a minor one may need different urgency, but both should retain the inspection link and a clear description. Define what containment means for the team’s vendor assessment practice. The containment state should point to a real temporary measure, not just a label.

For corrective actions, agree what evidence the owner supplies, who reviews it, and how the Reviewer will test effectiveness. The action record has root cause and action text plus dates, so the team should make those entries specific enough to assess. Also decide how to handle a due action that is still implementing: the due list should lead to a follow-up, while the status explains the work remaining.

An inspection check fails because a requested access-control artifact does not match the inspected period. The Reviewer records the failure as a nonconformance, describes the issue and selects severity. The Corrective Action Owner opens that record, writes the root cause and planned response, and accepts a due date. The original failed check remains available through the inspection.

After the owner implements the action, the Reviewer compares the new evidence with the original requirement. If it still covers the wrong period, the work should remain in effectiveness review rather than close. If the evidence addresses the original failure, the Reviewer can approve closure. This rehearsal tests the relationship between the finding, the action and the person deciding the final outcome.

• Open nonconformances — Failures in containment, investigation or disposition.
• Corrective actions due — Owned actions at or past their due date.
• Actions awaiting effectiveness review — Implemented work ready for a Reviewer decision.

Use correction and effectiveness to rehearse owner and Reviewer responsibilities. The inspection review page shows where the originating result is checked.