Course contents
Practitioner · Course 1: Social and Ethical Compliance · Lesson 4 of 5

Building a corrective action plan for an audit non-conformance

Level: PractitionerTime: 50 minutesOrder used: A (the T-shirt shape, reused domestically)Tool: Compliance audit tracker
This lesson follows lesson 10.1.3. It shows how a factory turns a recorded non-conformance into a corrective action plan the auditor and buyer can verify. This lesson uses a domestic Make to Stock example, a domestic brand's own compliance check of its supplier, to show the same method applies outside export auditing too.
BrandCedar & Co. (domestic brand, Make to Stock)
Supplier factoryDelta Garments' own domestic-facing line, running a Cedar & Co. T-shirt style
Non-conformanceMinor: three sampled personnel files missing a signed employment contract
OwnerKarim, production manager
Deadline requested30 days from the finding
Verification methodA follow-up document check, not a full repeat audit
02Opening

This page shows how a factory turns a recorded non-conformance into a corrective action plan naming its root cause, its fix, its owner, and its deadline

This page shows a factory manager, a merchandiser, or a domestic brand's own compliance staff how a factory responds to a recorded finding with a corrective action plan, rather than a verbal promise to "sort it out." At work, this means being able to decide whether a submitted plan actually names a root cause and a verifiable fix, or only restates the problem. This lesson mainly teaches a decision flow: judging whether a specific corrective action plan is acceptable before it is approved.

This matters to Cedar & Co., a domestic brand running its own compliance check of its supplier's line, since a brand that only sells domestically still has reason to know its supplier's labour conditions; to Karim, the production manager who owns the corrective action for a finding on his own floor; and to any manager who signs off a corrective action plan without checking whether it actually addresses the underlying cause. Without this skill, a factory closes a finding by fixing the one instance found, while the same underlying gap produces the identical finding again at the next audit.

03Before you start

What you need, and what this lesson does not cover

You need: lesson 10.1.3 (reading an audit finding and classifying it as a non-conformance).

By the end of this lesson you can:

  • state what a corrective action plan must name to be complete;
  • explain why a corrective action plan must address the root cause, not only the one instance already found;
  • set a deadline appropriate to a finding's severity rating;
  • judge whether a submitted corrective action plan is acceptable or needs to be sent back;
  • distinguish a corrective action, which fixes the instance found, from a preventive action, which stops it recurring.

Not covered here: what a social compliance audit checks (lesson 10.1.1), the core labour standards checked (lesson 10.1.2), classifying a finding's severity (lesson 10.1.3), and a complete tracker across several audits (lesson 10.1.5).

04Key terms

Words you will meet in this lesson

TermMeaning
Corrective action plan (CAP)A written plan a factory submits after an audit finding, stating the root cause, the action that will fix it, who owns that action, and the date it will be completed by.
Preventive actionA change made to stop a non-conformance's underlying cause from producing the same finding again, going beyond simply fixing the one instance already found.
Root-cause analysisAsking why a problem happened repeatedly until the real underlying cause is found, instead of fixing only its first visible symptom.
Verification auditA follow-up audit, usually of a specific corrective action plan already submitted, that checks whether the promised action was actually carried out and whether the original non-conformance is genuinely closed.
Non-conformanceA specific way in which an audited factory's practice fails to meet a required standard, recorded as one finding with its own severity rating and location, not a general impression that something is wrong.
05Teaching
The rule

A corrective action plan names a finding's root cause, the action that fixes it, an owner, and a deadline appropriate to the finding's severity

A corrective action plan is a written response to a recorded non-conformance that names the finding's root cause, the specific action that will fix it, the one person who owns that action, and the date it will be completed by, with the deadline set according to the finding's own severity rating. A plan that restates the problem without naming why it happened, or that names a fix without naming who owns it or by when, is not yet a corrective action plan an auditor or buyer can verify.

"We will fix it"No root cause named,no owner, no deadlineCannot be verified,cannot be checked as closedCorrective action planRoot cause, action, owner,and a deadline, all namedCan be checkedat a verification audit
A complete corrective action plan can be verified; a vague promise cannot. Naming the root cause, the action, the owner, and the deadline together is what makes a plan checkable.
What you meet in real life

The same four required elements apply to every corrective action plan, but the deadline and depth of the fix differ by severity and by how deep the root cause runs

What can differThe shapes you will meetWhy it matters
Deadline set by severityA Critical finding, such as a blocked fire exit, typically needs correction within days; a Major finding may allow weeks; a Minor finding, such as a missing signature, may allow a longer period such as 30 days.Confirms the deadline is not a fixed number for every plan; it is set according to how urgent the underlying risk actually is.
A one-instance fix versus a systemic fixCorrecting the one missing contract signature found is a corrective action; changing the hiring checklist so every new file is checked for a signature before filing is a preventive action, addressing the root cause rather than the single instance.Shows that a complete plan usually needs both: fixing what was found, and stopping the same gap from recurring.
A domestic brand's own compliance check versus an export buyer's auditCedar & Co., checking its own domestic supplier's compliance, requires the same corrective action plan structure — root cause, action, owner, deadline — as an export buyer's third-party audit would, even without a letter of credit or export shipment involved.Confirms the corrective action plan method does not depend on export or domestic business, or on MTO, MTS or a hybrid order; the same structure applies to any factory correcting any audit finding.
A plan that is sent back for being incompleteA submitted plan naming only "we will remind staff" without a root cause or a deadline is typically sent back for revision before it is accepted, rather than approved as submitted.Shows that an incomplete plan does not close a finding; the finding stays open until the plan itself meets the required structure.
The case we follow

Cedar & Co. requires Karim to submit a corrective action plan for the missing employment-contract signatures found at Delta Garments' domestic-facing line

Cedar & Co., the domestic brand running its own compliance check of Delta Garments' domestic-facing line (which produces a T-shirt style built on the same basic shape as Order A), finds three sampled personnel files missing a signed employment contract, classified as Minor. Cedar & Co. requires Karim, the production manager, to submit a corrective action plan within a set period, naming why the signatures are missing, how they will be obtained, who is responsible, and by when.

The worked number

Reading Karim's submitted corrective action plan against the four required elements, one by one

This lesson's worked output is not a cost figure; it is checking a submitted plan against the method's own four required elements.

Karim's submitted corrective action plan, checked element by element:
Root cause named? Yes — the hiring checklist did not include a step confirming a signed contract before filing
Action named? Yes — add a signature-confirmation step to the hiring checklist, and collect the three missing signatures
Owner named? Yes — Karim, production manager
Deadline named? Yes — 30 days from the finding, matching the Minor severity rating
= a complete corrective action plan, all four elements present and verifiable
Root causeChecklist stepmissingActionAdd step,collect signaturesOwnerKarimDeadline30 days
All four required elements are named in Karim's plan. A plan missing even one of these, such as an unnamed owner, is not yet complete enough for Cedar & Co. to accept and later verify.
The method

How to build and judge a corrective action plan correctly

  1. Ask why the finding happened, repeating the question until the real underlying cause is found, not only its first visible symptom (root-cause analysis).
  2. Name the specific action that fixes both the instance found and its root cause, distinguishing a one-off correction from a preventive change to the process.
  3. Name the one person who owns the action, rather than a department or "the team," so responsibility is clear.
  4. Set a deadline appropriate to the finding's severity rating, shorter for Critical, longer for Minor, never left open-ended.
  5. Check the submitted plan against these four elements before accepting it, sending it back for revision if any element is missing or vague.
  6. Verify the plan was actually carried out, usually through a follow-up document check or a verification audit, before marking the finding closed.
The trap

Accepting a corrective action plan that fixes only the one instance found, without addressing why it happened

A common mistake is accepting a plan that fixes the specific instance a finding named — collecting the three missing signatures — without asking why the gap existed in the first place. If the hiring checklist itself is not corrected, new hires can still be filed without a signed contract, and the same finding is likely to recur at the next audit, at the same or a higher severity if the pattern has grown. A corrective action plan that stops at "fixed the one we found" has addressed the symptom, not the cause.

06In plain words

A corrective action plan is a factory's written answer to a specific finding: what caused it, what will be done about it, who is doing it, and by when. A plan that only says "we will fix it" cannot be checked later, because there is nothing specific to check. The deadline should match how serious the problem is: dangerous things get fixed fast, smaller paperwork gaps get a longer but still real deadline. A good plan does two things, not one: it fixes the specific case that was found, and it changes whatever let that case happen, so the same problem does not simply come back at the next check.

07Quick check
  • A corrective action plan names a root cause, an action, an owner, and a deadline; missing any of these makes it incomplete.
  • The deadline is set by the finding's severity: shorter for Critical, longer for Minor, never open-ended.
  • A corrective action fixes the instance found; a preventive action stops the same gap recurring; a complete plan usually needs both.
  • An incomplete plan is sent back for revision, not accepted as submitted.
  • A finding stays open until its plan is both accepted and later verified as actually carried out.
  • The same corrective action plan structure applies whether the finding came from an export audit or a domestic brand's own compliance check.
08Workplace scenario

Cedar & Co. must decide whether to accept Karim's first submitted plan, which fixes the missing signatures but does not change the hiring checklist

Karim submits a first corrective action plan for the missing signature finding: "The three missing signatures have been collected. Closed." Cedar & Co.'s own compliance staff must decide whether this plan is acceptable before marking the finding closed.

  • What Karim's first plan states: the three specific missing signatures have been obtained.
  • What Karim's first plan does not state: why the signatures were missing in the first place, or any change to prevent the same gap recurring.
  • Cedar & Co.'s own requirement: a corrective action plan must name a root cause and a preventive action, not only a correction of the instance found.
  • The finding's severity: Minor, which allows a longer deadline but still requires the plan's full structure before acceptance.

The document Cedar & Co.'s compliance staff checks against Karim's submission:

Cedar & Co. — corrective action plan requirement (extract) A submitted plan must name: (1) the root cause, (2) the corrective action, (3) the responsible owner, (4) the deadline. A plan naming only a correction, without a root cause and a preventive step, is returned for revision.

Should Cedar & Co. accept Karim's first plan as submitted, given the three signatures have already been collected? Decide before opening the answer.

Show decision

No. Cedar & Co.'s own requirement lists four required elements, and Karim's first plan names only the correction, not the root cause or a preventive action, so it should be returned for revision.

First fact. The plan states the three missing signatures were collected, satisfying the correction itself, but names no reason why the signatures were missing.

Second fact. Without a stated root cause, there is no way to confirm the hiring checklist has been changed, so the same gap could recur at the next intake of new hires without anyone noticing until the next audit.

Cedar & Co. should return the plan, asking Karim to state the root cause (no signature-confirmation step in the hiring checklist) and the preventive action (adding that step), before accepting it and later verifying it. Accepting the plan as first submitted would close the finding on paper while leaving the same gap open in practice.

09What it costs

The risk of accepting a corrective action plan that fixes the instance found without addressing its root cause

Framed qualitatively, since this lesson is about judging a plan's completeness rather than a costing exercise: accepting an incomplete plan risks the same finding recurring at the next audit, forcing Delta Garments through the same corrective action process a second time, and risks Cedar & Co. relying on a compliance record that looks closed but is not genuinely fixed. A recurring finding at a later audit is also generally read as a worse sign than a first occurrence, since it suggests the factory's own corrective process did not work the first time.

10Working template

Compliance audit tracker: use the "Corrective action," "Action owner," "Due date," and "Status" columns together to hold one finding's full response

Open the Compliance audit tracker. For the missing-signature finding, the "Corrective action" column records both the correction and the preventive change (adding the checklist step), the "Action owner" column names Karim, the "Due date" column records the deadline, and the "Status" column moves from "Open" to "In progress" once the plan is accepted, then to "Verified" only after a follow-up check confirms the action was actually carried out. Download link: `templates/T10-C01-compliance-audit-tracker.xlsx`.

Download the Compliance audit tracker (Excel)

11Check yourself

1. What must a corrective action plan name to be considered complete?

2. In the worked scenario, why does Cedar & Co. return Karim's first submitted plan for revision?

3. A different factory submits a corrective action plan for a Critical finding (a blocked fire exit) with a 45-day deadline, the same deadline it used for an earlier Minor finding. What is wrong with this plan?

12Glossary
ENARFRTRMeaning
Corrective action plan (CAP)خطة الإجراء التصحيحيPlan d'action correctiveDüzeltici faaliyet planıA written plan a factory submits after an audit finding, stating the root cause, the action that will fix it, who owns that action, and the date it will be completed by.
Preventive actionالإجراء الوقائيAction préventiveÖnleyici faaliyetA change made to stop a non-conformance's underlying cause from producing the same finding again, going beyond simply fixing the one instance already found.
Root-cause analysisتحليل السبب الجذريAnalyse des causes profondesKök neden analiziAsking why a problem happened repeatedly until the real underlying cause is found, instead of fixing only its first visible symptom.
Verification auditتدقيق التحققAudit de vérificationDoğrulama denetimiA follow-up audit, usually of a specific corrective action plan already submitted, that checks whether the promised action was actually carried out and whether the original non-conformance is genuinely closed.
Non-conformanceعدم المطابقةNon-conformitéUygunsuzlukA specific way in which an audited factory's practice fails to meet a required standard, recorded as one finding with its own severity rating and location, not a general impression that something is wrong.
13Next

Lesson 5: Building a complete compliance audit tracker across multiple audits

You now know how to build a corrective action plan for one non-conformance. The next lesson brings this course's five lessons together into one complete tracker holding several audits, each with its own findings and plans. Back to the course map

14Ladder

RecognizeName the four elements a complete corrective action plan must include.
ConnectSee why a plan must address the root cause, not only the instance already found.
CompareTell a corrective action apart from a preventive action, and a Critical deadline apart from a Minor one.
DecideJudge whether a submitted corrective action plan is complete enough to accept, or must be returned for revision.