Clause 10.2: Incident, nonconformity and corrective action
The organization sets up, runs and keeps processes, covering reporting, investigation and action, for identifying and managing incidents and nonconformities.
What clause 10.2 asks
The organization sets up, runs and keeps processes, covering reporting, investigation and action, for identifying and managing incidents and nonconformities. Whenever one of these arises, it: responds promptly, acting to bring it under control and correct it and dealing with what it has caused; decides, with workers taking part and other relevant interested parties involved, whether corrective action is needed to remove the root causes so that the problem neither happens again nor happens somewhere else, by looking into the incident or examining the nonconformity, finding its causes, and finding out whether similar incidents or nonconformities exist or might arise; reviews, where appropriate, the assessments already made of OH&S risks and of other risks; decides on and carries out corrective action following the hierarchy of controls and the management of change; assesses the OH&S risks tied to new or altered hazards before acting; reviews whether the action taken worked; and changes the system where needed. Documented information is retained on what the incidents and nonconformities were, what was done about them, and what the corrective action achieved and how effective it was, and this is communicated to the relevant workers, their representatives and other relevant interested parties.
Corrective action has to remove the cause, not just the symptom. Workers take part, the risk assessment is revisited, and the effectiveness of the action is reviewed.
Draft 10.2 Nonconformity and corrective action, from clause 10.2. The draft contents keep the clause and shorten the title to Nonconformity and corrective action. The summaries describe no substantive change to the corrective action duties.
Evidence for clause 10.2
An auditor will take an incident and follow it from the report to the root cause, the risk assessment update and the effectiveness review.
- Incident investigationIncident and nonconformity register
- Incident investigationInvestigation reports with root cause analysis and worker participation
- Incident investigationCorrective actions showing hierarchy of controls applied
- Incident investigationRisk assessment reviews triggered by incidents
- Incident investigationEffectiveness reviews and communication records to workers
Where clause 10.2 commonly fails
- Investigations stop at immediate cause
- Workers not involved in investigations
- Risk assessments not updated after incidents
- Effectiveness of corrective actions not reviewed
What to do about clause 10.2 before the revision
Add a root cause section that goes past the immediate cause. Involve the workers concerned. Update the risk assessment before the action closes. Review effectiveness after a set period. Communicate the finding to the workers it concerns.
What the record shows for clause 10.2
An auditor working on clause 10.2 will start with Incident and nonconformity register. The failure this record sees most often is Investigations stop at immediate cause. Both are carried into the kit as row 39, with an owner field and a dated action.
Read across from clause 10.2
Read the next clause in the group, or open the full index. The revision map shows the draft structure.
Source for clause 10.2: ISO 45001:2018, clause 10.2, retrieved 18 October 2026. The draft note rests on the public DIS contents and the two named summaries; the requirement, evidence and gaps are written from the held clause record. Every source.