The phrase “Undue Delay” is a tempting strategy, but not foolproof.
In our latest training video, Miriam arrives flustered and sweaty to inform Tommy, the CEO, that the internal audit turned up some nonconformities. Tommy, more interested in prepping his boat for the weekend, responds with his usual brand of delegation: “Just give it to Carol.”
You can see the video by clicking the link below.
Carol, of course, is the only one in the building who understands what the ISO 9001 standard actually requires. But she’s outnumbered by executives who believe certification is about appearances, not systems.
In this episode, Tommy unveils his clever workaround to avoid immediate corrective action: redefine “without undue delay” as “within six months.”
It’s a classic move. And it’s one I’ve seen in real life.
ISO 9001 Clause 10.2.1: What Does It Really Say?
The standard requires that organizations:
“Take action to eliminate the cause of the nonconformity, in order that it does not recur… Corrective actions shall be appropriate to the effects of the nonconformities encountered.”
It never specifies a timeline. That’s by design.
ISO 9001 gives organizations flexibility. You’re allowed to define what “timely” means within your own context. If you need 30, 60, or even 90 days to perform a proper root cause analysis and implement a solution, that’s your call.
But that flexibility comes with responsibility. If your inaction causes further problems, the auditor doesn’t just look at your calendar. They look at your outcomes.
When Delay Becomes a System Failure
In an upcoming video, the auditor will grit his teeth, and allow, Tommy’s six-month buffer to go unchallenged. The auditor reviews the internal audit findings and raises an eyebrow. Being professional, our cartoon auditor will avoid the dreaded Auditor Overreach.
That’s realistic. A good auditor won’t issue a nonconformity just because your timeline feels long. They will, however, start connecting dots. And when they find those dots lead to a returned product in the MDR cage—a product with the same issue flagged three months earlier in the internal audit—that’s when it becomes a major finding.
This is the part many new quality professionals miss: it’s not just about whether the paperwork is complete. It’s about whether the system works.
When a known nonconformity is left unresolved, and defective product continues to flow to customers, you’re no longer dealing with a documentation lapse. You’re dealing with a systemic failure to control and correct issues.
Auditors Dislike a Vacuuum
Most of my clients have already heard this. Auditors dislike a vacuum, and when they see one, they tend to fill it in with something from his or her own experience. This is the very definition of Auditor Overreach, but it is hard to not do. The surest way to avoid it, such as in this case, is for the cliennt to define a good faith estimate of timeliness, or the auditor will do it for you.
Defining Timeliness: A Right and a Risk
Yes, organizations are allowed to define what “timely” means. That might be 15 days for minor findings or 90 days for complex issues. But once you define it, two things happen:
- You create a standard by which your system will be judged.
- You give auditors a measurable reference for compliance.
Auditors aren’t in the business of telling you how to run your company. But once you publish a policy or a corrective action procedure that promises resolution within a certain time, it becomes fair game.
If you miss your own timeline? That’s a finding. If you delay to the point of customer impact? That’s a major finding.
Interpretive Guidelines: The Contract They Never Read
Some registrars publish “interpretive guidelines” as part of their certification agreements. These documents often include expectations beyond the standard—such as full-system internal audits every 12 months or 30-day closure targets for corrective actions.
In many facilities, no one on the quality team has ever seen these guidelines. They were agreed to by someone in legal or upper management, and promptly forgotten. That leaves people like Miriam and Tommy blindsided during the audit.
Our fictional auditor, however, plays it cool. He mentions “external requirements” and “contractual expectations” in the opening meeting. When no one reacts, he knows exactly what kind of audit this will be.
Teaching Point: You Can Delay, But You Can’t Escape Consequences
Here’s the key lesson for your team:
- ISO 9001 gives you the power to define your own timelines including “Undue Delay” But that power isn’t a shield against reality.
- Containment must be immediate. Root cause can take time, but action must be appropriate to risk.
- The longer you delay, the more likely your system will fail in ways that can’t be hidden.
Tommy thought he could game the language. But when the returned product in the MDR cage matched the ignored internal audit finding, the loophole slammed shut.
As the auditor put it:
“This isn’t a paperwork issue. This is a failure to control your process.”
Final Thoughts on Undue Delay
Inexperienced quality professionals often treat ISO like a checklist. But it’s more like a mirror: it reflects your system, warts and all. The wise ones understand that defining “timely” corrective action isn’t about delay. It’s about risk, responsibility, and readiness.
Because in the end, the question isn’t when you acted.
It’s whether your system prevented the problem from recurring.
And no six-month buffer can fix that. Undue Delay is not a protection.
Want more audit wisdom with a splash of sarcasm? Subscribe or check out our full video series, featuring Carol, Tommy, Miriam, and the rest of the ISO circus.
Did you know I am a published author?
I have a lot to say about this, and a lot of other ISO and Quality Systems related issues. Click the links below, and join my Author page.
How not to Fail at ISO9001
Why People Don’t Do Their Jobs—the Four Root Causes of Everything
Why People Still Don’t Do Their Jobs—The Four Root Causes of Everythinghttps://www.amazon.com/gp/product/B0CRNZ1WYR?ref_=dbs_mng_crcw_0&storeType=ebooks&qid=1751384837&sr=1-1
