Templates and records · ISO 22000 · Clause 10.1

ISO 22000 nonconformities and corrective actions record template

A CCP deviation, an audit finding or a consumer complaint: put today's problem right, find the cause and check that it does not happen again.

In one sentence

The ISO 22000 nonconformities and corrective actions record documents the nature of each nonconformity, whether of product or of the system, its correction, the cause, the corrective action and its effectiveness, because clauses 8.9.2, 8.9.3 and 10.1 require that information to be retained.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 22000 · Clause 10.1 Clauses are cited using the numbering of ISO 22000:2018, the current edition. ISO is preparing a third edition that may renumber them; when it is published it will have its own transition period.
Type of information: Mandatory record Documented information to be retained (8.9.2, 8.9.3 and 10.1.2)
Who fills it in: Whoever detects it, plus the process owner The process owner takes on the analysis and quality verifies closure
When: As soon as it is detected Effectiveness is verified once enough time has passed to see whether it recurs
How long it is kept: Set by the organisation ISO 22000 only sets a minimum for traceability (8.3: the shelf life of the product). Covering the shelf life plus the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 22000 demands and what it leaves to your judgement

ISO 22000 deals with nonconformities in two places. Clause 8.9 covers product and process nonconformities: if a CCP fails its critical limit or an OPRP its criterion, corrections are applied, the need for corrective action is evaluated and the nature of the nonconformity, its cause and its consequences are retained, together with the information needed for traceability.

Clause 10.1 covers those of the system: audit findings, complaints, PRP failures. You react, analyse the cause, consider whether it could recur elsewhere, apply the action, review its effectiveness and, if necessary, update the system.

The standard does not require a particular root cause method. It requires the action to be proportionate to the effect and its effectiveness to be checked.

Read it in context: Improvement and updating of the system, in the ISO 22000 Academy

Structure

Fields the template should include

Number, date and source: CCP or OPRP monitoring, verification, audit, complaint, authority
Type: product or process (8.9) or system (10.1)
Description and evidence
Batch affected and reference to the product-on-hold record, if any
Immediate correction
Root cause analysis
Could it recur in another process or product?
Corrective action, owner and deadline
Verification of effectiveness: date, criterion and result
Update of the hazard analysis, plan or PRPs, where applicable

Example

Example: metal detector failure

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Number and source	CA-26-014 · CCP-2 monitoring · 3 March 2026
Type	Product and process (8.9)
Description	The detector did not reject the stainless steel test piece in the 12:00 check
Batch	L26-062: product since 11:00 held and rerun through another detector
Root cause	Sensitivity was readjusted after a format change and was not recorded as a planned change
Could it recur elsewhere?	Same risk on the line 1 detector
Corrective action	Lock the sensitivity setting behind a maintenance password and handle every format change as a planned change · 20 March
Effectiveness	30 June: 41 format changes with no incidents in the test piece checks · Effective
Update	A sensitivity check after each format change is added to the verification plan

At the audit

Mistakes auditors commonly flag

The cause stops at "operator error".
CCP deviations are corrected, but nobody assesses whether corrective action is needed.
The action is closed without verifying its effectiveness.
The action is not reflected in the hazard analysis or the plan when it should be.
Consumer complaints are handled separately and never reach this record.

In Kimobox

How this record is kept in Kimobox

1The nonconformity is opened from the deviation, the audit or the complaint, with a classified source.
2The root cause is mandatory to move forward.
3The action is assigned with a date, and the system warns you if it slips.
4Verification of effectiveness is scheduled within the same record.

Frequently asked questions

What people ask us before getting started

What is the difference between correction and corrective action?

Correction deals with the effect — holding the product and rerunning it; corrective action eliminates the cause — locking the detector setting. ISO 22000 asks for them separately.

Does every CCP deviation need a corrective action?

You have to evaluate whether one is needed. An isolated deviation with a known cause may not require it, but the decision must be recorded; if it recurs, the need is obvious.

Keep your ISO 22000 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring