145.A.95 Findings and observations

FINDING-RELATED CORRECTIVE ACTION PLAN AND IMPLEMENTATION After receiving the notification of findings, the organisation should identify and define the actions for all findings to address the effects of the non-compliance and its root cause(s) and contributing factor(s). Depending on the issues, the organisation may need to take immediate corrections. The corrective action plan should: include the correction of the issue, corrective actions and preventive actions, as well as the planning to implement these actions; be timely submitted to the competent authority for acceptance before it is effectively implemented. After receiving the acceptance of the corrective action plan from the competent authority, the organisation should implement the associated actions. Within the agreed period, the organisation should inform the competent authority that the corrective action plan has been completed and should send the associated evidence, as requested by the competent authority.

DUE CONSIDERATION TO OBSERVATIONS For each observation notified by the competent authority, the organisation should analyse the related issues and determine when actions are needed. The handling of the observations may follow a process similar to the handling of the findings by the organisation. The organisation should record the analysis and the outputs, such as the actions taken or the reasons for not taking actions.

ROOT CAUSE ANALYSIS

(a)It is important that the analysis does not primarily focus on establishing who or what caused the non-compliance, but on why it was caused. Establishing the root cause(s) often requires an overarching view of the events and circumstances that led to it, to identify all the possible systemic and contributing factors (regulatory, technical, human factors, organisational factors, etc.) in addition to the direct factors.

(b)A narrow focus on single events or failures, or the use of a simple, linear model, such as a fault tree, to identify the chain of events that led to the non-compliance, may not properly reflect the complexity of the issue, and therefore there is a risk that important factors that must be addressed in order to prevent a reoccurrence will be ignored. Such an inappropriate or partial root cause analysis often leads to defining ‘quick fixes’ that only address the symptoms of the non-conformity. A peer review of the results of the root cause analysis may increase its reliability and objectivity.