The intent of §4.5.3 is that the organization put in place procedures for 1) identifying actual and potential nonconformities to EMS requirements, 2) taking appropriate corrective or preventive action, and 3) reviewing the effectiveness of corrective or preventive actions taken.
The nonconformity requirement of ISO 14001:1996 was a passive requirement in that it was only triggered when a nonconformity came to the attention of the organization through one of the other EMS procedures, such as the EMS audit or management review. ISO 14001:2004, however, requires that the organization establish and maintain procedures to identify actual or potential nonconformities, determine their causes, take action to avoid recurrence or occurrence, record results, and review effectiveness of corrective or preventive actions.
How the organization goes about identifying actual or potential nonconformities is up to it to determine. From the standpoint of registration auditors, it would seem that they would want to see a specific procedure requiring members of the organization to conduct some kind of periodic checklist driven, walk-through inspection for nonconformities. In addition, the procedure should allow for submission of nonconformities by any member of the organization. Actual nonconformities are usually fairly evident and relatively easy to investigate because there is a tangible occurrence with which to deal. The organization should also want to evaluate minor instances of nonconformity that, while not significant in and of themselves, if they occurred under different circumstances, could lead to a significant deviation from the EMS. Such “near misses” could be identified by the occurrence of a sudden, unexpected event, a failure to achieve an objective or target, or a deviation from the Environmental Policy.
Potential nonconformities are more difficult to identify and correct. Here, application of Failure Mode and Effects Analysis would be appropriate for organizations having that capability.
When investigating nonconformities, organizations should focus on identifying underlying root causes, not just the immediate manifestation of the problem. If a chemical storage drum leaks, the organization should take action, first, to mitigate the damage and, then, to determine why the leak occurred; e.g., improper or negligent handling, mechanical failure, or lack of a leak detection system. Corrective or preventive actions should then focus on eliminating the cause through training, communication of procedures, use of leak-resistant drums, or installation of a leak detection system.
Other ISO 14001 sections, principally Emergency Preparedness and Response, Internal Audit, and Management Review, are tools that the organization implements in order to help identify instances of actual or potential nonconformity. The underlying principle of these sections is that the identification of nonconformities should be made by the organization through diligent application of these tools, not from the occurrence of an environmental event, a customer or community complaint, or investigation by a regulatory authority. While §4.5.3 does not specifically mention disciplinary action, in many cases disciplinary action or the threat of disciplinary action is appropriate to prevention of future nonconformities. Many organizations have written codes of conduct that give employees notice that deviations from the codes will not be tolerated and that prescribed penalties can result for infractions. These codes can be expanded to include penalties for deviations from the EMS. If so, penalties should be commensurate with the violation itself and should acknowledge the nature of the environmental damage, the degree of negligence, prior conduct, and the forthrightness of the employee being disciplined. Any such code and its remedies should be administered fairly and consistently and should have as its objective correction and prevention of EMS nonconformities, not punishment of employees.
Finally, identification, investigation, and correction of nonconformities leads to the need to revise documented procedures.
