# Quality Management (QMS): Nonconformity & CAPA

> Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review.

- **What it is:** Quality management for ISO 9001: findings with a real root cause, corrective actions checked later, internal audits and a management review.
- **For:** Manufacturing
- **Odoo versions:** 16.0, 17.0, 18.0, 19.0, 20.0 - Community and Enterprise
- **Runs on:** Odoo.sh or Odoo you host yourself - not Odoo Online, which accepts no third-party apps
- **Price:** 179 EUR, one-time, on the Odoo Apps Store
- **Technical name:** bambooforge_qms
- **Not for:** Document and record control is not here: it belongs to a document management system, and BambooForge DMS covers controlled copies and print registers.; Risk and opportunity registers (clause 6.1) are not modelled.; The app records the system; it does not certify it. Which conflicts and clauses matter is your auditor's call.
- **Compared with the alternatives:** https://docs.bambooforge.dev/bambooforge_qms/compare/
- **Manual:** https://docs.bambooforge.dev/bambooforge_qms/
- **Live demo:** https://demo20.bambooforge.dev/odoo/action-bambooforge_qms.action_bf_qms_nonconformity
- **Store page:** https://apps.odoo.com/apps/modules/20.0/bambooforge_qms
- **Manual last updated:** 2026-09-21

---
# Quality Management (QMS): Nonconformity & CAPA

## What this is for

Odoo Community has no quality module — `quality_control` is Enterprise. This
app covers the clauses an ISO 9001 audit actually spends its time on, in the
order the standard asks for them.

## Nonconformities (clause 10.2)

*Quality ▸ Operations ▸ Nonconformities*

The workflow follows the clause rather than a generic ticket flow, because
that is how an auditor reads the record:

1. **Reported** — what was found, stated against the requirement it fails.
   "Wrong part shipped" is an event; "shipped part does not match the drawing
   revision on the order" is a nonconformity.
2. **Contained** — what was done straight away to stop it spreading. The
   report will not move on until this is written down.
3. **Root cause** — with a named method. If the answer is "operator error",
   the analysis has usually stopped one step early.
4. **Action taken** — at least one action, or an explicit note saying why none
   is needed. A nonconformity with neither is what gets written up.
5. **Effectiveness check** — the step everybody skips.
6. **Closed** — with a closure note, and only once every action has been
   judged.

## Actions

An action knows whether it is a **correction** (fixes the part in front of
you) or a **corrective action** (stops the next one). Auditors care that you
know the difference.

Marking an action done is not the end of it. It needs evidence — a document
number, a training record — and it gets an effectiveness date a month out, far
enough for the process to have run again. Until somebody answers, the daily
scheduler keeps asking. An action judged **not effective** puts its
nonconformity back into root-cause analysis, because the cause is still there
whatever the paperwork says.

## Internal audits (clause 9.2)

Scope, clauses, lead auditor, auditees, conclusion. Two rules are enforced
rather than assumed:

- an auditor cannot appear among the auditees — auditing your own work is the
  finding, not the audit;
- an audit cannot be closed while its findings are still open.

Every finding raised from an audit becomes a tracked nonconformity linked back
to it.

## Management review (clause 9.3)

The 9.3.2 inputs are fields, not a free-text minute, and the review will not be
marked held while the main ones are blank — a review that cannot show what was
on the table is the most common finding against this clause. The period's own
figures (audits held, nonconformities raised, actions overdue) are computed, so
the meeting argues about numbers nobody had to retype.

Closing needs at least one output: an improvement decision, a change to the
system, or a resource need.

## Recurrence

A nonconformity can point back at an earlier one. A repeat is evidence that the
last corrective action did not work — which is a finding in its own right, and
the form says so.

## Known limits

- Document and record control is not here: it belongs to a document management
  system, and BambooForge DMS covers controlled copies and print registers.
- Risk and opportunity registers (clause 6.1) are not modelled.
- The app records the system; it does not certify it. Which conflicts and
  clauses matter is your auditor's call.

## How we make sure it works

Before every release, **28 automated checks** run against this app on Odoo 16, 17, 18, 19 and 20.
Among them:

- The worker reads audits and reviews but cannot run them.
- Effectiveness cannot be judged before the action is done.
- The worker cannot delete the record of a problem.
- An audit cannot close over open findings.
- An auditor cannot audit their own work.

The complete list is in the source you receive.

## Install

1. Copy `bambooforge_qms` into your addons path and update the app list, or install the ZIP from the Odoo Apps Store.
2. Install **Quality Management (QMS): Nonconformity & CAPA**.
3. Open **Quality** - its menus are Operations, Management System.

## Questions people ask

****Which Odoo versions does it run on?****

Odoo 16.0, 17.0, 18.0, 19.0, 20.0, on the series you buy it for; each series is its own listing.

****Community or Enterprise?****

Both. It needs no Enterprise app.

****What does it need?****

The standard Discuss, Settings apps. No extra Python package.

****Where does it show up?****

Under the **Quality** menu (Operations, Management System).

****Does anything leave my server?****

No. It makes no call outside your Odoo server: no telemetry, no licence check, no third-party service.

****What happens if I uninstall it?****

Odoo drops the app's own tables and fields; the standard records it worked on (contacts, orders, products) stay as they are.