
Quality Management (QMS): Nonconformity & CAPA
Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review.
Available for Odoo 16.0, Odoo 17.0, Odoo 18.0, Odoo 19.0, Odoo 20.0. Technical name bambooforge_qms.
Transcript of the walkthrough (Odoo 20)
Quality Management (QMS): Nonconformity & CAPA. Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review. Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them.
Quality ▸ Operations ▸ Nonconformities In the next few minutes: what this is for, then nonconformities (clause 10.2), then actions, then internal audits (clause 9.2), then management review (clause 9.3). Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Quality then Operations then Management System. 1.
Copy bambooforge_qms into your addons path and update the app list, or install the ZIP from the Odoo Apps Store. 2. Install Quality Management (QMS): Nonconformity & CAPA. 3.
Open Quality - its menus are Operations, Management System. What this is for. Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them.
Nonconformities (clause 10.2). The workflow follows the clause rather than a generic ticket flow, because that is how an auditor reads the record: 1. Reported — what was found, stated against the requirement it fails. "Wrong part shipped" is an event; "shipped part does not match the drawing revision on the order" is a nonconformity.
2. Contained — what was done straight away to stop it spreading. The report will not move on until this is written down. 3.
Root cause — with a named method. If the answer is "operator error", the analysis has usually stopped one step early. 4. Action taken — at least one action, or an explicit note saying why none is needed.
A nonconformity with neither is what gets written up. 5. Effectiveness check — the step everybody skips. 6.
Closed — with a closure note, and only once every action has been judged. Actions. An action knows whether it is a correction (fixes the part in front of you) or a corrective action (stops the next one). Auditors care that you know the difference.
Marking an action done is not the end of it. It needs evidence — a document number, a training record — and it gets an effectiveness date a month out, far enough for the process to have run again. Until somebody answers, the daily scheduler keeps asking. An action judged not effective puts its nonconformity back into root-cause analysis, because the cause is still there whatever the paperwork says.
Internal audits (clause 9.2). Scope, clauses, lead auditor, auditees, conclusion. Two rules are enforced rather than assumed: an auditor cannot appear among the auditees — auditing your own work is the finding, not the audit; an audit cannot be closed while its findings are still open. Every finding raised from an audit becomes a tracked nonconformity linked back to it.
Management review (clause 9.3). The 9.3.2 inputs are fields, not a free-text minute, and the review will not be marked held while the main ones are blank — a review that cannot show what was on the table is the most common finding against this clause. The period's own figures (audits held, nonconformities raised, actions overdue) are computed, so the meeting argues about numbers nobody had to retype. Closing needs at least one output: an improvement decision, a change to the system, or a resource need.
Recurrence. A nonconformity can point back at an earlier one. A repeat is evidence that the last corrective action did not work — which is a finding in its own right, and the form says so. How we make sure it works.
Before every release, 28 automated checks run against this app on Odoo 16, 17, 18, 19 and 20. Among them: The worker reads audits and reviews but cannot run them. Effectiveness cannot be judged before the action is done. The worker cannot delete the record of a problem.
An audit cannot close over open findings. An auditor cannot audit their own work. The complete list is in the source you receive. Questions people ask.
Which Odoo versions does it run on? Odoo 16.0, 17.0, 18.0, 19.0, 20.0, on the series you buy it for; each series is its own listing. Community or Enterprise? Both.
It needs no Enterprise app. Now the part most videos leave out: what this does not do. Document and record control is not here: it belongs to a document management system, and BambooForge DMS covers controlled copies and print registers. Risk and opportunity registers (clause 6.1) are not modelled.
The app records the system; it does not certify it. Which conflicts and clauses matter is your auditor's call. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.




Transcript of the walkthrough (Odoo 19)
Quality Management (QMS): Nonconformity & CAPA. Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review. Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them.
Quality ▸ Operations ▸ Nonconformities In the next few minutes: what this is for, then nonconformities (clause 10.2), then actions, then internal audits (clause 9.2), then management review (clause 9.3). Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Quality then Operations then Management System. What this is for.
Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them. Nonconformities (clause 10.2). The workflow follows the clause rather than a generic ticket flow, because that is how an auditor reads the record: 1.
Reported — what was found, stated against the requirement it fails. "Wrong part shipped" is an event; "shipped part does not match the drawing revision on the order" is a nonconformity. 2. Contained — what was done straight away to stop it spreading.
The report will not move on until this is written down. 3. Root cause — with a named method. If the answer is "operator error", the analysis has usually stopped one step early.
4. Action taken — at least one action, or an explicit note saying why none is needed. A nonconformity with neither is what gets written up. 5.
Effectiveness check — the step everybody skips. 6. Closed — with a closure note, and only once every action has been judged. Actions.
An action knows whether it is a correction (fixes the part in front of you) or a corrective action (stops the next one). Auditors care that you know the difference. Marking an action done is not the end of it. It needs evidence — a document number, a training record — and it gets an effectiveness date a month out, far enough for the process to have run again.
Until somebody answers, the daily scheduler keeps asking. An action judged not effective puts its nonconformity back into root-cause analysis, because the cause is still there whatever the paperwork says. Internal audits (clause 9.2). Scope, clauses, lead auditor, auditees, conclusion.
Two rules are enforced rather than assumed: an auditor cannot appear among the auditees — auditing your own work is the finding, not the audit; an audit cannot be closed while its findings are still open. Every finding raised from an audit becomes a tracked nonconformity linked back to it. Management review (clause 9.3). The 9.3.2 inputs are fields, not a free-text minute, and the review will not be marked held while the main ones are blank — a review that cannot show what was on the table is the most common finding against this clause.
The period's own figures (audits held, nonconformities raised, actions overdue) are computed, so the meeting argues about numbers nobody had to retype. Closing needs at least one output: an improvement decision, a change to the system, or a resource need. Recurrence. A nonconformity can point back at an earlier one.
A repeat is evidence that the last corrective action did not work — which is a finding in its own right, and the form says so. Now the part most videos leave out: what this does not do. Document and record control is not here: it belongs to a document management system, and BambooForge DMS covers controlled copies and print registers. Risk and opportunity registers (clause 6.1) are not modelled.
The app records the system; it does not certify it. Which conflicts and clauses matter is your auditor's call. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.




Transcript of the walkthrough (Odoo 18)
Quality Management (QMS): Nonconformity & CAPA. Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review. Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them.
Quality ▸ Operations ▸ Nonconformities In the next few minutes: what this is for, then nonconformities (clause 10.2), then actions, then internal audits (clause 9.2), then management review (clause 9.3). Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Quality then Operations then Management System. What this is for.
Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them. Nonconformities (clause 10.2). The workflow follows the clause rather than a generic ticket flow, because that is how an auditor reads the record: 1.
Reported — what was found, stated against the requirement it fails. "Wrong part shipped" is an event; "shipped part does not match the drawing revision on the order" is a nonconformity. 2. Contained — what was done straight away to stop it spreading.
The report will not move on until this is written down. 3. Root cause — with a named method. If the answer is "operator error", the analysis has usually stopped one step early.
4. Action taken — at least one action, or an explicit note saying why none is needed. A nonconformity with neither is what gets written up. 5.
Effectiveness check — the step everybody skips. 6. Closed — with a closure note, and only once every action has been judged. Actions.
An action knows whether it is a correction (fixes the part in front of you) or a corrective action (stops the next one). Auditors care that you know the difference. Marking an action done is not the end of it. It needs evidence — a document number, a training record — and it gets an effectiveness date a month out, far enough for the process to have run again.
Until somebody answers, the daily scheduler keeps asking. An action judged not effective puts its nonconformity back into root-cause analysis, because the cause is still there whatever the paperwork says. Internal audits (clause 9.2). Scope, clauses, lead auditor, auditees, conclusion.
Two rules are enforced rather than assumed: an auditor cannot appear among the auditees — auditing your own work is the finding, not the audit; an audit cannot be closed while its findings are still open. Every finding raised from an audit becomes a tracked nonconformity linked back to it. Management review (clause 9.3). The 9.3.2 inputs are fields, not a free-text minute, and the review will not be marked held while the main ones are blank — a review that cannot show what was on the table is the most common finding against this clause.
The period's own figures (audits held, nonconformities raised, actions overdue) are computed, so the meeting argues about numbers nobody had to retype. Closing needs at least one output: an improvement decision, a change to the system, or a resource need. Recurrence. A nonconformity can point back at an earlier one.
A repeat is evidence that the last corrective action did not work — which is a finding in its own right, and the form says so. Now the part most videos leave out: what this does not do. Document and record control is not here: it belongs to a document management system, and BambooForge DMS covers controlled copies and print registers. Risk and opportunity registers (clause 6.1) are not modelled.
The app records the system; it does not certify it. Which conflicts and clauses matter is your auditor's call. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.




Transcript of the walkthrough (Odoo 17)
Quality Management (QMS): Nonconformity & CAPA. Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review. Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them.
Quality ▸ Operations ▸ Nonconformities In the next few minutes: what this is for, then nonconformities (clause 10.2), then actions, then internal audits (clause 9.2), then management review (clause 9.3). Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Quality then Operations then Management System. What this is for.
Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them. Nonconformities (clause 10.2). The workflow follows the clause rather than a generic ticket flow, because that is how an auditor reads the record: 1.
Reported — what was found, stated against the requirement it fails. "Wrong part shipped" is an event; "shipped part does not match the drawing revision on the order" is a nonconformity. 2. Contained — what was done straight away to stop it spreading.
The report will not move on until this is written down. 3. Root cause — with a named method. If the answer is "operator error", the analysis has usually stopped one step early.
4. Action taken — at least one action, or an explicit note saying why none is needed. A nonconformity with neither is what gets written up. 5.
Effectiveness check — the step everybody skips. 6. Closed — with a closure note, and only once every action has been judged. Actions.
An action knows whether it is a correction (fixes the part in front of you) or a corrective action (stops the next one). Auditors care that you know the difference. Marking an action done is not the end of it. It needs evidence — a document number, a training record — and it gets an effectiveness date a month out, far enough for the process to have run again.
Until somebody answers, the daily scheduler keeps asking. An action judged not effective puts its nonconformity back into root-cause analysis, because the cause is still there whatever the paperwork says. Internal audits (clause 9.2). Scope, clauses, lead auditor, auditees, conclusion.
Two rules are enforced rather than assumed: an auditor cannot appear among the auditees — auditing your own work is the finding, not the audit; an audit cannot be closed while its findings are still open. Every finding raised from an audit becomes a tracked nonconformity linked back to it. Management review (clause 9.3). The 9.3.2 inputs are fields, not a free-text minute, and the review will not be marked held while the main ones are blank — a review that cannot show what was on the table is the most common finding against this clause.
The period's own figures (audits held, nonconformities raised, actions overdue) are computed, so the meeting argues about numbers nobody had to retype. Closing needs at least one output: an improvement decision, a change to the system, or a resource need. Recurrence. A nonconformity can point back at an earlier one.
A repeat is evidence that the last corrective action did not work — which is a finding in its own right, and the form says so. Now the part most videos leave out: what this does not do. Document and record control is not here: it belongs to a document management system, and BambooForge DMS covers controlled copies and print registers. Risk and opportunity registers (clause 6.1) are not modelled.
The app records the system; it does not certify it. Which conflicts and clauses matter is your auditor's call. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.




Transcript of the walkthrough (Odoo 16)
Quality Management (QMS): Nonconformity & CAPA. Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review. Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them.
Quality ▸ Operations ▸ Nonconformities In the next few minutes: what this is for, then nonconformities (clause 10.2), then actions, then internal audits (clause 9.2), then management review (clause 9.3). Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Quality then Operations then Management System. What this is for.
Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them. Nonconformities (clause 10.2). The workflow follows the clause rather than a generic ticket flow, because that is how an auditor reads the record: 1.
Reported — what was found, stated against the requirement it fails. "Wrong part shipped" is an event; "shipped part does not match the drawing revision on the order" is a nonconformity. 2. Contained — what was done straight away to stop it spreading.
The report will not move on until this is written down. 3. Root cause — with a named method. If the answer is "operator error", the analysis has usually stopped one step early.
4. Action taken — at least one action, or an explicit note saying why none is needed. A nonconformity with neither is what gets written up. 5.
Effectiveness check — the step everybody skips. 6. Closed — with a closure note, and only once every action has been judged. Actions.
An action knows whether it is a correction (fixes the part in front of you) or a corrective action (stops the next one). Auditors care that you know the difference. Marking an action done is not the end of it. It needs evidence — a document number, a training record — and it gets an effectiveness date a month out, far enough for the process to have run again.
Until somebody answers, the daily scheduler keeps asking. An action judged not effective puts its nonconformity back into root-cause analysis, because the cause is still there whatever the paperwork says. Internal audits (clause 9.2). Scope, clauses, lead auditor, auditees, conclusion.
Two rules are enforced rather than assumed: an auditor cannot appear among the auditees — auditing your own work is the finding, not the audit; an audit cannot be closed while its findings are still open. Every finding raised from an audit becomes a tracked nonconformity linked back to it. Management review (clause 9.3). The 9.3.2 inputs are fields, not a free-text minute, and the review will not be marked held while the main ones are blank — a review that cannot show what was on the table is the most common finding against this clause.
The period's own figures (audits held, nonconformities raised, actions overdue) are computed, so the meeting argues about numbers nobody had to retype. Closing needs at least one output: an improvement decision, a change to the system, or a resource need. Recurrence. A nonconformity can point back at an earlier one.
A repeat is evidence that the last corrective action did not work — which is a finding in its own right, and the form says so. Now the part most videos leave out: what this does not do. Document and record control is not here: it belongs to a document management system, and BambooForge DMS covers controlled copies and print registers. Risk and opportunity registers (clause 6.1) are not modelled.
The app records the system; it does not certify it. Which conflicts and clauses matter is your auditor's call. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.




Key facts
- What it is
- Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review.
- For
- Manufacturing
- Odoo versions
- 16.0, 17.0, 18.0, 19.0, 20.0 - Community and Enterprise
- Runs on
- Odoo.sh or Odoo you host yourself - not Odoo Online, which accepts no third-party apps
- Price
- 179 EUR, one-time, on the Odoo Apps Store
- Technical name
- bambooforge_qms
- Not for
- Document and record control is not here: it belongs to a document management system, and BambooForge DMS covers controlled copies and print registers.; Risk and opportunity registers (clause 6.1) are not modelled.; The app records the system; it does not certify it. Which conflicts and clauses matter is your auditor's call.
- Compared with the alternatives
- https://docs.bambooforge.dev/bambooforge_qms/compare/
- Manual last updated
- 2026-09-21
Quality Management (QMS): Nonconformity & CAPA
What this is for
Odoo Community has no quality module — quality_control is Enterprise. This app covers the clauses an ISO 9001 audit actually spends its time on, in the order the standard asks for them.
Nonconformities (clause 10.2)
Quality ▸ Operations ▸ Nonconformities
The workflow follows the clause rather than a generic ticket flow, because that is how an auditor reads the record:
Reported — what was found, stated against the requirement it fails. "Wrong part shipped" is an event; "shipped part does not match the drawing revision on the order" is a nonconformity.
Contained — what was done straight away to stop it spreading. The report will not move on until this is written down.
Root cause — with a named method. If the answer is "operator error", the analysis has usually stopped one step early.
Action taken — at least one action, or an explicit note saying why none is needed. A nonconformity with neither is what gets written up.
Effectiveness check — the step everybody skips.
Closed — with a closure note, and only once every action has been judged.
Actions
An action knows whether it is a correction (fixes the part in front of you) or a corrective action (stops the next one). Auditors care that you know the difference.
Marking an action done is not the end of it. It needs evidence — a document number, a training record — and it gets an effectiveness date a month out, far enough for the process to have run again. Until somebody answers, the daily scheduler keeps asking. An action judged not effective puts its nonconformity back into root-cause analysis, because the cause is still there whatever the paperwork says.
Internal audits (clause 9.2)
Scope, clauses, lead auditor, auditees, conclusion. Two rules are enforced rather than assumed:
an auditor cannot appear among the auditees — auditing your own work is the finding, not the audit;
an audit cannot be closed while its findings are still open.
Every finding raised from an audit becomes a tracked nonconformity linked back to it.
Management review (clause 9.3)
The 9.3.2 inputs are fields, not a free-text minute, and the review will not be marked held while the main ones are blank — a review that cannot show what was on the table is the most common finding against this clause. The period's own figures (audits held, nonconformities raised, actions overdue) are computed, so the meeting argues about numbers nobody had to retype.
Closing needs at least one output: an improvement decision, a change to the system, or a resource need.
Recurrence
A nonconformity can point back at an earlier one. A repeat is evidence that the last corrective action did not work — which is a finding in its own right, and the form says so.
Known limits
Document and record control is not here: it belongs to a document management system, and BambooForge DMS covers controlled copies and print registers.
Risk and opportunity registers (clause 6.1) are not modelled.
The app records the system; it does not certify it. Which conflicts and clauses matter is your auditor's call.
How we make sure it works
Before every release, 28 automated checks run against this app on Odoo 16, 17, 18, 19 and 20. Among them:
The worker reads audits and reviews but cannot run them.
Effectiveness cannot be judged before the action is done.
The worker cannot delete the record of a problem.
An audit cannot close over open findings.
An auditor cannot audit their own work.
The complete list is in the source you receive.
Install
Copy bambooforge_qms into your addons path and update the app list, or install the ZIP from the Odoo Apps Store.
Install Quality Management (QMS): Nonconformity & CAPA.
Open Quality - its menus are Operations, Management System.
Questions people ask
- Which Odoo versions does it run on?
Odoo 16.0, 17.0, 18.0, 19.0, 20.0, on the series you buy it for; each series is its own listing.
- Community or Enterprise?
Both. It needs no Enterprise app.
- What does it need?
The standard Discuss, Settings apps. No extra Python package.
- Where does it show up?
Under the Quality menu (Operations, Management System).
- Does anything leave my server?
No. It makes no call outside your Odoo server: no telemetry, no licence check, no third-party service.
- What happens if I uninstall it?
Odoo drops the app's own tables and fields; the standard records it worked on (contacts, orders, products) stay as they are.