Free module of Dokuflex, the low-code BPM platform with AI, to keep the register of nonconformities and corrective actions (CAPA): audit findings, complaints and process deviations with mandatory root cause, action with owner and deadline, effectiveness verification and approved closure. The register an ISO 9001, 14001, 45001 or 27001 auditor expects to find, without rebuilding it the week before.
The four standards share the high-level structure and, with some differences in vocabulary, ask for the same thing when a nonconformity appears. Clause 10.2 of ISO 9001:2015 lists it: react (control, correct and deal with the consequences), evaluate the need to eliminate the cause (review and analyse the nonconformity, determine its causes and check whether similar ones exist or could occur), implement the action, review the effectiveness of the action taken, update risks and opportunities where appropriate and change the management system if necessary. And retain documented information as evidence of the nature of the nonconformity, the actions and their results.
What an auditor checks, therefore, is not that a list of findings exists: it is that each one has an analysed cause, an action with owner and deadline, verification that the action worked and evidence of all of it. When each of those steps fails and how to set up the circuit is explained in ISO 9001 nonconformities: why most are closed badly (in Spanish).
The nonconformity spreadsheet works until you have to prove something. In an internal or certification audit, the auditor opens three or four records at random and asks about the cause, the action and the proof of effectiveness. That is where the usual problems appear:
The familiar result: a week before the audit, the quality manager rebuilds the register, asks for evidence over WhatsApp and closes by hand what has been open for months. That effort does not improve any process; it only dresses up the register. A system with rules avoids the problem at the source: it does not let the nonconformity move forward without what the standard requires at each step. In the meantime, the free Excel template for an ISO 9001 nonconformity register (template in Spanish) at least separates correction, root cause, corrective action and effectiveness verification into different columns.
Nonconformities and corrective actions (CAPA) software records each audit finding, complaint or deviation and takes it through five steps (containment, root cause, action, effectiveness verification and closure) with rules that prevent skipping any of them, and keeps the history as documented information for the auditor. Dokuflex offers it as a free module of its low-code BPM platform.
The module comes with a complete process, as is, with the fields and rules described here. Everything can be changed with the low-code designer, but nothing needs to be touched to get started.
Header with automatic number (NC-1, NC-2…), type (nonconformity, observation, improvement opportunity, customer complaint), status and detection date. Finding panel: source (internal or external audit, complaint, inspection, process, supplier), standard (ISO 9001, 14001, 45001, 27001, IFS/BRC), severity (minor, major, critical), requirement or clause not met, process or area, who detected it, description and attached evidence. Immediate containment panel: immediate action and date. Root cause analysis panel: method (5 whys, Ishikawa, 8D), root cause and contributing causes. Corrective or preventive action panel: type, owner, estimated cost, description, planned date and actual implementation date. Effectiveness verification and closure panel: verification method, date, action effective?, closure date and remarks.
The root cause is mandatory to move to Action in progress, Verification or Closed; in Action in progress the action description, the owner and the planned date are also mandatory. If the severity is critical, the immediate containment action is mandatory. If the source is an internal or external audit, the standard must be stated. The verification fields (date and effective?) only appear in Effectiveness verification and Closed, and on closure the verification result and the closure date are mandatory. Nobody can close a nonconformity “because it is already done”.
The Start processing button launches the flow; when the action has been verified, the owner requests Approve closure. If the approver accepts, the system marks the nonconformity as Closed and sets the closure date; if they reject it, it goes back to Under analysis with the comment recorded. Each step stays in the history with user and date: it is the documented information the standard asks for, generated without extra effort.
Four KPI cards (open, in action, critical, closed) above a filterable grid with type, source, standard, severity, area, detection date, planned action date, status, flow status and owner, exportable to Excel. A kanban board by status for the weekly follow-up. And a dashboard with six charts: nonconformities by status, by source, by severity, by standard, by type and detected per month. It is the material for the “nonconformities and corrective actions” item of the management review (clause 9.3) and the evidence of continual improvement (10.3), without building pivot tables.
It is activated from the module catalogue of any Dokuflex account, in the “Regulatory compliance” group, and is operational in under a minute:
Five panels (finding, containment, root cause, action, verification and closure), automatic NC-{n} numbering, attached evidence and user selection for detected by and owner.
Mandatory fields and visibility conditioned by status, severity and source, aligned with the items of clause 10.2.
Processing, approval or rejection of closure with return to analysis, automatic update of status and date, notifications and history.
Cards for open, in action, critical and closed; eleven-column grid with Excel export; kanban board by status.
Status, source, severity, standard, type and monthly detection trend, ready for the management review.
Real cases from ISO 9001, 14001, 45001, 27001 and IFS/BRC in different statuses, and tours of the form, the list and the dashboard to train the team in ten minutes.
If you need your own fields (line, shift, customer, product code), a different approver by severity or to integrate it with the rest of your processes on the low-code BPM platform, it is done from the designer without programming. The procedures and instructions you revise after a corrective action are controlled in the AI document management system, with automatic versioning and change control.
The same register works for managing ISO audit findings, internal or certification, in quality, environment, health and safety and information security, with the standard field to separate the systems when the organisation holds several certificates.
Batches without a control record, labelling complaints, process deviations and IFS/BRC or ISO 22000 audit findings. Critical severity with mandatory containment and trend by line or area. More in BPM for manufacturing.
Care quality incidents, laboratory deviations and ISO 9001 or ISO 27001 audit findings on medical records. Attached evidence and closure approved by the quality director. More in BPM for healthcare.
Annex A controls not implemented, insufficient log retention, access rights not reviewed. The same circuit works for nonconformities under Spain's ENS security scheme; combine it with the document management system aligned with ENS Medium.
Consumption outside target, unanchored shelving detected during inspection, near misses. The “improvement opportunity” type for what is not a nonconformity but deserves action, and effectiveness verification with monitoring data.
Clause 10.2 expressly includes customer complaints, and clause 8.4 requires control of what suppliers deliver. The form comes with the “customer complaint” type and the “supplier” source, so a complaint about a delay or a rejected batch enters the same circuit as an audit finding: containment, root cause, action with owner and deadline, effectiveness verification and approved closure. The dashboard splits nonconformities by source, which is what the quality manager needs to see whether the problem lies in an internal process or with a specific supplier, and to take that data to the supplier evaluation.
ISO 9001:2015 no longer speaks of “preventive actions” as a separate process: it integrates them into risks and opportunities (6.1). For what is not a nonconformity but deserves action, the “improvement opportunity” type goes through the same circuit and leaves the same evidence.
If you are looking for ISO 9001 quality management software for an SME, it helps to know which part this module solves. Dokuflex's quality CAPA software is free and is activated in under a minute: it covers clause 10.2 (nonconformities, complaints and audit findings with root cause, action, effectiveness verification and approved closure) and the dashboard for the management review. It is not a complete QMS: document control goes in the AI document management system, and the internal audit programme, supplier evaluation or risks and opportunities are modelled on the same low-code BPM platform with the designer, without programming, with plans from €25/user/month.
If your scope goes beyond ISO 9001, the “Regulatory compliance” group of the catalogue includes other free modules:
Early warning within 24 h, notification within 72 h and final report within a month as mandatory fields, with closure approved by the CISO. It is for security incidents; the ISO 27001 corrective actions from your audits are recorded in this nonconformity module.
Data subject requests with their one-month deadline and breaches with the 72-hour countdown for the Spanish data protection authority (AEPD), in a case file with the DPO's workflow.
The AI systems inventory the EU AI Act will ask you for, with risk classification and 11 automatic rules, ready in an afternoon.
The same group also contains the KYC and due diligence file (Spain's Law 10/2010) and the AICA food supply contracts.
In an ISO 27001 audit, clause 10.2 is demonstrated with evidence: each finding with its root cause, the corrective action with owner and deadline, the effectiveness verification and who approved the closure. You do not need a complete suite for that; a register that turns those steps into mandatory fields is enough, and that is what the free Dokuflex module does. ISMS nonconformities coexist with those of ISO 9001, 14001 or 45001 in the same register, separated by the Standard field.
If what you are looking for is ISMS software that also manages risk analysis, Annex A controls or business continuity, that part fits better in a GRC platform, and Dokuflex can coexist with it: the nonconformity list exports to Excel and the platform integrates with other tools through the low-code iPaaS with 200+ connectors and REST API. The corrective actions, with the history of who changed what and when, stay in a single register.
Yes. The four standards share the high-level structure and clause 10.2 asks for the same thing: react, analyse the cause, act, review effectiveness and retain documented information. The form has a Standard field with ISO 9001, ISO 14001, ISO 45001, ISO 27001, IFS/BRC and Other, and the dashboard splits nonconformities by standard, so an integrated management system uses a single register.
A correction eliminates the nonconformity that was detected (withdrawing the batch, relabelling, extending log retention). A corrective action eliminates the cause so that it does not happen again. The module separates them into two panels, Immediate containment and Corrective or preventive action, and does not allow moving to Action in progress without a root cause.
No. When the status is changed to Closed, the Action effective? field and the closure date are mandatory, and closure goes through an approval step. If the approver rejects it, the nonconformity goes back to Under analysis with the reason recorded in the history. This is exactly what item d of clause 10.2 asks for: review the effectiveness of the action taken.
Each nonconformity keeps the finding with attached evidence, the containment, the analysis method (5 whys, Ishikawa, 8D), the root cause, the action with its owner and planned and actual dates, the effectiveness verification with date and result, and the history of who changed what and when, including closure approval. The list exports to Excel and the dashboard shows the trend by month, source, severity and standard.
The module is free: it is activated from the module catalogue of a Dokuflex account, in the Regulatory compliance group, in under a minute. It comes with a form, a list with KPI cards and grid, a kanban board, a dashboard with six charts, a closure approval workflow, 11 automatic rules, six sample records and three guided tours. It can be adapted with the low-code designer without programming.
No. The module provides the circuit and the evidence: it forces you to record cause, action, owner, deadline and verification, and it retains the documented information. Whether the root cause is the right one or the action is proportionate to the effects is decided by your organisation; that is what the auditor assesses. Dokuflex provides traceability; compliance is the company's responsibility.
It is where the documented information required by clause 10.2 is retained: the nature of each nonconformity, the actions taken and their results. In practice it records number, date, source, standard, severity, requirement not met and evidence, plus containment, root cause, action with owner and deadline, effectiveness verification and closure. The Dokuflex module comes with those fields, mandatory according to status.
Yes. CAPA (corrective and preventive actions) is the name quality software usually gives to the clause 10.2 process. The module covers the full cycle: finding, containment, root cause, corrective or preventive action, effectiveness verification and approved closure, and its dashboard feeds the management review. The procedures you change are controlled in the AI document management system, with automatic versioning.
Create the nonconformity with source internal or external audit and standard ISO 27001, and state in the requirement not met the clause or the Annex A control affected. The form requires the root cause and the action with owner and planned date, and does not let you close without verifying effectiveness. Security incidents with NIS2 or DORA deadlines go to the free incident register module.
Yes. The type customer complaint and the source supplier come in the form, together with internal or external audit, inspection and process, so the findings of a supplier audit also fit. If the severity is critical, immediate containment is mandatory, and the dashboard splits nonconformities by source so you can see at a glance where they concentrate.
It does not claim to be. It covers clause 10.2 of the ISMS: the nonconformities and corrective actions from internal and external audits, with mandatory root cause, action with owner and deadline, and effectiveness verification. For risk analysis, ISO 27001 controls or business continuity you can combine it with a GRC tool: the list exports to Excel and the platform offers a REST API.
In the European Union. The Dokuflex platform holds ISO 27001, operates in line with Spain's ENS Medium level (certification in progress) and hosts data exclusively in data centres in Frankfurt, Madrid and Ireland. Support is in English and Spanish, and the module is activated free of charge from the catalogue, with no card and no implementation project, so the quality team can record its first nonconformity the same day.
A major nonconformity is the total failure to meet a requirement of the standard or a systematic failure that casts doubt on the management system's ability to achieve its results; a minor one is an isolated deviation that does not compromise the system. In a certification audit, a major requires an action plan and evidence of closure before the certificate is issued or maintained. The Severity field of the form (minor, major, critical) distinguishes each case and the dashboard separates them; with critical severity, immediate containment is mandatory.
Yes, as the register of nonconforming outputs required by clause 8.7 of ISO 9001: the immediate containment panel records the action taken on the product or service (rework, concession, rejection or return) and its date, before deciding whether a corrective action on the cause is also needed. The documented information of 8.7.2 (description, actions, concessions and who decided) stays in the same nonconformity with its evidence.
No. The module covers clause 10.2 (nonconformities and corrective actions) and audit findings, with the dashboard that feeds the management review. Controlled documents (procedures, instructions, records) go in the Dokuflex AI document management system, and the internal audit programme, supplier evaluation or risks and opportunities (6.1) are modelled on the same low-code BPM platform with the designer, without programming.
Guidance prepared by the Dokuflex Compliance Team. The texts of the standards are paid and are consulted at ISO or your national standards body; for your certification, follow your certification body's criteria.
Activate the nonconformities and corrective actions module in your Dokuflex account, load the six samples, follow the tour and record the first real finding today. Free, no card required.