Foreword

The ASF Sentinel Event Policy governs what happens when serious harm occurs at an organization ASF has accredited. Nothing in ASF's own documents, until this one, governed what happens when ASF itself gets something wrong — a missed deadline, an inaccurate public registry entry, a survey scheduled against the wrong version of a standard. These are genuinely different problems requiring a genuinely different, but equally real, process, consistent with ISO 9001 Clause 10.2 [1].

1. Purpose and What Counts as an Internal Nonconformity

An internal nonconformity is any instance where ASF's own operations did not meet a requirement ASF has set for itself in one of its own governing documents — for example [1]:

• A survey scheduled or conducted against an outdated version of a standard
• A public registry entry that does not accurately reflect an organization's actual current status
• A missed deadline under any ASF procedure — a complaint response window, an appeal decision timeline, a Public Disclosure Notice's one-business-day requirement
• A conflict of interest that should have been identified and was not

This procedure does not apply to a patient safety event at an accredited organization, which is governed by the ASF Sentinel Event Policy, or to a concern about an accredited organization's own compliance, which is governed by the ASF Public Complaints & Feedback Policy. This procedure is specifically about ASF's own conduct of its own processes.

2. Why Verification Matters: The Real Evidence

This procedure's emphasis on independently verifying that a corrective action actually worked, rather than merely confirming it was carried out, is not a bureaucratic add-on. Industry benchmarking of corrective action programs finds that organizations with mature, effective processes achieve independent verification rates above eighty-five percent — while rates below seventy percent are recognized as a specific warning sign of what the same research calls a culture of checkbox completion rather than genuine problem-solving [2].

The real-world difference this makes is not abstract. A published quality-improvement study in infection prevention and control compared corrective action outcomes before and after introducing a more structured root-cause and verification process: corrective action implementation rates rose from 57.6 percent to 88.9 percent, and — the outcome that actually matters — event recurrence within sixty days fell from 19.2 percent to 3.7 percent, a statistically significant improvement [3]. The same body of practice identifies a recurrence rate below fifteen to twenty percent within a defined follow-up window as the accepted benchmark for a genuinely effective corrective action process [4].

3. Sources of Identification

A nonconformity under this procedure may be identified through:

• A finding from the ASF Internal Audit Procedure
• A finding from external review under Section 7.5 of How ASF Develops and Revises Standards
• A discussion during the ASF Management Review Procedure
• A complaint filed under the ASF Public Complaints & Feedback Policy that, on investigation, reveals the fault was ASF's own process rather than the accredited organization's
• Any ASF staff member, Council member, or surveyor who simply notices something is wrong and reports it — self-identification is treated the same as any other source, not as a lesser or more suspect one

4. Root Cause Analysis

Before a correction is treated as complete, the individual responsible for addressing the nonconformity determines why it happened — not only what happened — consistent with ISO 9001's requirement to evaluate the need for action that eliminates the actual cause, not merely the visible symptom [1]. Correcting a single inaccurate registry entry without asking why it was inaccurate risks the same error recurring the next time the same condition arises.

The root cause analysis also asks whether the same underlying condition could have caused, or could still cause, a similar nonconformity elsewhere in ASF's operations — not only in the specific instance identified.

5. Corrective Action and Verification

5.1 Immediate Correction

The immediate, visible problem is corrected as soon as practicable — the registry entry is fixed, the survey is rescheduled against the current standard — regardless of how long the root cause analysis takes to complete.

5.2 Corrective Action

Once the root cause is understood, a corrective action addressing that cause — not only the immediate symptom — is defined, with a named individual responsible and a completion date.

5.3 Verification of Effectiveness

A corrective action is not considered closed merely because the defined action was carried out. Consistent with ISO 9001's explicit requirement to review the effectiveness of corrective action taken [1], and the real verification-rate benchmark described in Section 2, someone other than the individual who implemented the corrective action confirms, after a reasonable period, that the same nonconformity has not recurred and that the underlying cause genuinely appears to have been addressed.

6. Relationship to Other ASF Processes

• Nonconformities identified through internal audit are tracked back to the ASF Internal Audit Procedure's own findings, closing the loop that procedure explicitly defers to this one
• The pattern of nonconformities across a period is a required input to the ASF Management Review Procedure, not a matter left to individual correction alone
• A nonconformity that reveals a genuine gap in an ASF governing document is addressed through that document's own revision process — Section 12 of How ASF Develops and Revises Standards for a standard, or the relevant policy's own review cycle for a governance document — not through an ad hoc fix that never becomes part of the actual written procedure

References

1. International Organization for Standardization. ISO 9001:2015, Quality Management Systems — Requirements, Clause 10.2 (Nonconformity and Corrective Action). Geneva: ISO; 2015.
2. ETQ. The 7 Metrics Every Root Cause Analysis (RCA) Should Deliver to Executives. 2025.
3. Streamlining Root Cause Analysis of Healthcare-Associated Infections and Outbreaks Using a Mobile App-Based Digital Platform: A Quality Improvement Study. 2026.
4. ETQ. Recurrence rate benchmarking for effective corrective action processes. 2025.

Annex A — Nonconformity and Corrective Action Record

Nonconformity description: _____________________________________________

Source (Section 3): ________________________________________

Date identified: ______________________________

Immediate Correction

Action taken: _____________________________________________

Date completed: ______________________________

Root Cause Analysis

_______________________________________________________________________

☐ Assessed whether the same cause could affect other areas of ASF's operations

Corrective Action

Action defined: _____________________________________________

Responsible individual: ________________________________________

Target completion date: ______________________________

Effectiveness Verification

Verified by (not the individual who implemented the action): ________________________________________

Verification date: ______________________________

☐ Confirmed: nonconformity has not recurred

☐ Not confirmed — further action required (describe below)

_______________________________________________________________________

Index

Checkbox Completion (real risk), 2

Corrective Action, 5.2

Immediate Correction, 5.1

Recurrence Rate Benchmark, 2

Root Cause Analysis, 4

Sources of Identification, 3

Verification Rate (85% benchmark), 2, 5.3

ASF holds accredited organizations to a standard of genuine correction, not paperwork. This procedure holds ASF to the same one — and the real evidence shows that standard is measurable, not merely aspirational.