Corrective Action Plan

An auditor hands you a non-conformance report. A Listeria swab comes back positive in your ready-to-eat zone. A customer complaint lands in your inbox. Suddenly, a corrective action plan becomes the one thing standing between you and a failed re-audit, a regulatory warning, or a product recall.

A non-conformance left unresolved can cascade into a GFSI scheme suspension, an FDA observation, or worse. Getting your corrective action process right protects consumers, your brand, and your business.

This guide walks you through every step, from the moment you identify a problem through to verified close-out.

What is a corrective action plan?

A corrective action plan (CAP) is a documented, root-cause-driven plan that identifies why a problem occurred and specifies the actions needed to eliminate that root cause and prevent recurrence.

That definition matters. A CAP goes well beyond a promise to retrain an employee or add a sign to the wall. It is a structured response that traces a non-conformance back to its systemic origin and fixes it there.

In food manufacturing, corrective actions carry direct safety implications. Inadequate responses to non-conformances are a consistent thread in FDA warning letters, USDA FSIS notices of intended enforcement, and GFSI scheme suspensions. When a CAP fails, it rarely fails because the team was careless. It usually fails because the response addressed a symptom rather than a cause.

Where corrective action plans come from

Non-conformances that require a formal corrective action plan can originate from many sources:

• Third-party and regulatory audit findings: GFSI scheme audits (SQF, BRCGS, FSSC 22000), FDA inspections, and USDA FSIS in-plant inspections all generate observations and non-conformances that require documented responses within defined windows.
• Customer complaints: A complaint alleging foreign material, mislabeling, or illness triggers an investigation obligation under most food safety plans and retailer codes of practice.
• Internal non-conformances: Product failing a specification, a CCP deviation, or a GMP observation identified by your own team.
• Environmental monitoring positives: A Listeria or Salmonella environmental positive in a production zone requires immediate corrective action under FSMA Preventive Controls for Human Food and most GFSI schemes.
• Deviations and process failures: Anything that falls outside a critical limit, operational prerequisite program (OPRP) limit, or validated process parameter.
• Supplier non-conformances: Incoming material failures or supplier audit findings often generate supplier corrective action requests (SCARs), a parallel process discussed later.

Correction vs corrective action vs preventive action

These three terms are used interchangeably in practice, and that confusion is one of the most common reasons CAPs get rejected at audit. They are distinct actions with different purposes and timing.

Under ISO 9001:2015 Clause 10.2, organisations must react to nonconformities with corrections and corrective actions, then evaluate whether similar nonconformities could exist elsewhere. That last step is preventive action, and it is where most operations fall short.

The distinction also matters when you look at quality control vs quality assurance: QC catches the non-conformance; the corrective action system fixes the underlying reason it slipped through.

The 5 steps of a corrective action plan

Step 1: Identify and describe the problem

Before you can fix anything, you need a clear, factual description of what went wrong. Vague problem statements produce vague corrective actions.

A strong problem description answers: What happened? Where? When? How much product is involved? What standard was not met? Reference the specific requirement, whether a clause number, specification, or critical limit.

Apply SMART framing from the start. The problem should be specific (zone 3 swab returned a Listeria positive on 14 June), measurable (one positive from a 12-point monthly programme), and framed against a clear standard (the OPRP requires zero positives in RTE zones).

Step 2: Contain it

Containment is the correction step. Act immediately to stop the non-conformance from causing further harm while the investigation runs.

For a product concern, place affected lots on hold, initiate a traceability review, and notify relevant stakeholders. For a process deviation, stop or adjust the process, segregate potentially affected output, and document every action with a timestamp and owner.

Document containment actions even if they feel obvious. Auditors expect to see evidence that you isolated the problem before proceeding.

Step 3: Investigate the root cause

This is the step where most corrective action plans fail. "Operator error" and "training gap" are not root causes. They are symptoms of a deeper failure, whether in procedure design, supervision, equipment reliability, or management system oversight.

A SMART root cause investigation is time-bound, assigns a responsible investigator by name, and produces a documented, evidence-based conclusion. The root cause analysis section below covers specific methods.

Step 4: Implement corrective and preventive actions

Once you have a verified root cause, define the actions that will eliminate it. Each action needs an owner, a due date, and a description specific enough that someone else could confirm it was done.

Corrective actions address the identified root cause in the specific area where the non-conformance occurred. Preventive actions extend the fix to similar processes, equipment, or locations where the same failure mode could exist.

Every action should be achievable and relevant: a procedure revision is only a corrective action if the missing or incorrect procedure was actually the root cause.

Step 5: Verify effectiveness and close out

A corrective action plan is not closed until you have evidence that the actions worked. Effectiveness verification is a planned check, conducted after the corrective action has had time to demonstrate results.

For an environmental positive, that might be a targeted swab programme over four to eight weeks. For a documentation non-conformance, a review of the next ten completed records. Define the verification criteria before you start, document the results, and sign off by a competent authority.

How to do root cause analysis (so your CAP actually holds)

The most commonly rejected corrective action in GFSI audits is one that lists "retraining" as the root cause without explaining why the training failed. That is a symptom, not a cause.

Effective root cause analysis finds the systemic failure: the breakdown in a process, system, or control that allowed the non-conformance to occur. The ASQ root cause analysis resource is a useful primer on methods.

The 5 Whys

The 5 Whys is the most practical tool for most food manufacturing non-conformances. Start with the problem and ask why it occurred. Then ask why that answer is true. Repeat until you reach a systemic cause you can actually change.

Example using a CCP monitoring failure:

1. Non-conformance: Metal detector critical limit check not recorded at 2:00 PM.
2. Why? The line operator did not complete the check.
3. Why? The operator was covering a break on an adjacent line.
4. Why? There was no back-up protocol for CCP monitoring coverage during breaks.
5. Why? The HACCP plan assigns monitoring by name but does not specify a deputy.
6. Root cause: The HACCP plan lacks a cross-coverage protocol, so a single absence disables a critical control.

The corrective action now writes itself: update the HACCP monitoring procedure to assign a named deputy for each CCP monitoring task.

Fishbone (Ishikawa) for complex deviations

When a non-conformance could have multiple contributing causes, a fishbone diagram structures the investigation across Man, Machine, Method, Material, Measurement, and Environment (the 6Ms). It is particularly useful for allergen incidents, environmental pathogen findings, and multi-lot product failures.

The BRCGS guidance on root cause analysis recommends combining the fishbone with the 5 Whys rather than choosing between them.

How to test whether you found the real root cause

Before you document a root cause, ask: if you fixed only this, would the non-conformance be impossible to recur? If the answer is "probably not," you have not reached the root yet.

Also ask whether the same root cause could explain other non-conformances in the same process. If yes, your preventive action scope needs to expand.

A worked corrective action plan example (food manufacturing)

Scenario: An environmental swab programme returns a Listeria monocytogenes positive from a floor drain in Zone 2 of a ready-to-eat deli slicing room.

This scenario illustrates the connection between a strong environmental monitoring programme and your ability to respond effectively. See critical control point examples for how CCPs and OPRPs interact in an RTE environment, and review how corrective actions in your HACCP plan should be pre-specified for CCP deviations under Principle 5.

Corrective action plans and food safety compliance

Corrective action requirements vary across standards and regulations. Each scheme has its own trigger, timeline, and close-out expectation. The table below maps the key ones.

The FSIS monitoring and corrective action training material is a useful reference if your facility processes under USDA jurisdiction.

Aligning your corrective action process to these requirements is a core part of your food safety plan, whether you are operating under FSMA, the seven HACCP principles, or a GFSI scheme. If you are preparing for a SQF audit, BRCGS certification, or FSSC 22000 Version 6, your corrective action records will receive close scrutiny.

Allera's food quality management software gives FSQA teams a single system to log non-conformances, assign and track corrective actions, attach evidence, and document close-out, so nothing falls through the cracks when a 28- or 30-day deadline is running.

Closing out audit non-conformances on deadline

When a GFSI scheme auditor raises a major non-conformance, the clock starts immediately. BRCGS Issue 9 requires root cause analysis and a preventive action plan within 28 days. SQF Edition 9 expects full close-out of major non-conformances within 30 days. Miss the deadline and you risk certificate suspension.

Auditors expect more than a written plan. They want evidence: completed records, updated procedures (version-controlled and signed), training records dated after the corrective action, and verification results with dates and names. "Procedures have been updated" is not evidence. The updated procedure, with its effective date and the training record attached, is.

The most common reasons corrective action plans get rejected at close-out review:

• Symptom-level root cause: The investigation stopped at operator error without asking why the operator was in a position to make that error.
• Missing verification: The CAP describes actions but has no planned check to confirm they worked.
• Vague ownership: "QA team" is not an owner. A named individual with a due date is.
• Missed deadlines: Actions were not completed within the required window, even when the work was good.
• No preventive action: The corrective action fixed the specific occurrence but the CAP did not consider whether the same failure mode exists elsewhere.

Preparing for a food safety audit requires having your corrective action system audit-ready before the auditor arrives, not after. Review your SQF audit checklist and GMP audit checklist to confirm your CAP records are complete and accessible.

Common corrective action plan mistakes

Even experienced quality teams make predictable errors when corrective action volume spikes.

Treating correction as corrective action. Pulling product off the line and re-sanitising is a correction. Necessary, but not a corrective action. If you close the non-conformance at that stage, the root cause is still live.

Blaming the operator. "Staff retraining" appears in a large proportion of CAPs. It is almost never the root cause. People make mistakes when systems allow them to.

Vague owners and open-ended dates. "The team will implement by end of quarter" is not a corrective action. Name the person. Set the date.

No effectiveness check. A procedure can be written and filed without changing behaviour on the floor. Plan the verification step when you plan the action, not as an afterthought.

One-off fixes that ignore systemic recurrence. If one allergen risk assessment was incomplete, ask whether all of them use a consistent process.

Getting these right is a function of having a well-designed food safety management system. See a food safety management system for a broader view of the systems that support effective corrective action.

Managing corrective actions at scale

A spreadsheet works for ten corrective actions a year. It breaks down quickly when you are managing a high-audit-frequency facility, multiple sites, or both internal non-conformances and supplier issues simultaneously.

The problems are predictable: actions get assigned in email, due dates live in someone's inbox, verification results are not linked to the original non-conformance, and when an auditor asks for the last 12 months of CAPs you are assembling a document package instead of exporting a report.

A functional CAPA workflow should assign actions to named owners, send reminders before deadlines, escalate overdue items, capture verification evidence against the original record, and retain a complete audit trail.

Document control is closely tied to this. When a corrective action requires a procedure update, it needs to go through version control, reach the people who work to it, and leave a training record. Document control software handles that loop automatically, connecting the CAP to the procedure change and the training record.

Supplier non-conformances add another layer. When incoming material fails or a supplier audit generates findings, you need to issue a supplier corrective action request (SCAR) and track the response before approving future shipments. Supplier management tooling keeps SCARs visible alongside your internal corrective actions.

At scale, the difference between a team that closes non-conformances on time and one that struggles is rarely the quality of the people. It is whether the system makes the right action easy and the missed deadline visible. Allera's food quality management software is built to close that gap, with CAPA workflows that move your team from identification through to verified close-out without losing the audit trail.