Why a repeat finding costs more than a new one

In December 2025 a member of the Elsmar Cove quality forum posted what they called “an example of what not to do.” The auditor had written a nonconformance for a calibration issue. The company’s corrective action “looked like the problem was properly investigated and resolved,” and the auditor signed it off about three weeks later. “When I returned the next year, I went out to the area in the shop where it was recognized and found no change in their operation and no one in that area was even aware of it.” A discussion at management review, promised in the response, had left no record. The ending: “I had no trouble escalating it to a major.”

The first time, the finding was about calibration. The second time, the real question was whether the fix had ever reached the shop, and the same nonconformance came back as a major. In a 2022 thread about an ISO 9001 major for a repeat issue, a member said what a repeat like that can point to: “The fact that you had a nonconformance in a process is not (really) a big deal. The fact that you had the SAME nonconformance in the SAME process (after implementing a corrective action for the previous failure) is a bigger deal.” It “can possibly indicate a fault in your corrective action process.”

A repeat, graded

Medical device makers audited under the Medical Device Single Audit Program (MDSAP) see this written into the grading. Each nonconformity gets a grade from 1 to 5, under a scheme the Global Harmonization Task Force published in 2012. As the FDA laid it out at a 2018 workshop, a finding against the ISO 13485 clauses that bear directly on design and manufacturing controls starts at 3. A repeat is defined as a nonconformity that “refers to the same sub-clause (X.X.X) as another NC identified within either of two previous QMS audits which evaluated the same sub-clause.” The instruction: “Increase the grade by 1.”

One grade changes who hears about it. Under the program’s post-audit policy, if auditors find “one or more nonconformity grade 5” or “more than two nonconformities grade 4,” the auditing organization must inform the regulators within 5 working days of the end of the audit. A grade 3 finding that comes back is a grade 4. Three of those in one audit, and the notice goes out.

Read as a leadership problem

FDA warning letters to drug makers read repeats the same way. In November 2023 the agency wrote to a Philadelphia manufacturer that it had cited similar observations in 2021, that the company had proposed fixes, and that “our current inspection identified multiple failures to implement your specific corrective actions.” Then a sentence that shows up, nearly word for word, in letter after letter: “These repeated failures demonstrate that executive management oversight and control over the manufacture of drugs is inadequate.”

When the repeat crosses plants, the letters say that too. A June 2019 letter to a drug maker’s New Jersey plant has a section titled “Repeat Violations at Multiple Sites.” It notes that “FDA cited similar CGMP violations at other facilities in your company’s network,” and tells the company to “immediately and comprehensively assess your company’s global manufacturing operations.”

These repeated failures demonstrate that executive management oversight and control over the manufacture of drugs is inadequate.

What counts as a repeat

What counts as “repeat” is where it gets slippery. The FDA’s own workshop slides list the concern: “Some subclauses include multiple requirements so 2 NC relative to the same subclause may have little in common (unrelated cause, impact, etc.).” The same list includes “Applicability across a multi-facility organization.”

Companies write their own definitions. A global company’s working definition, posted in 2015: “a Similar finding identified at any other audit (globally) within the last 18 months and/or the previous equivalent audit applying only to major findings for the same issue/root cause.” Another member warned that many groups “game the definitions so they never find any,” and remembered two similar knee injuries kept apart because “one injury was to a left knee, and the other to a right knee.” A third gave the reason repeats spread across sites: “They result globally if an effective correction is not shared and/or implemented globally.”

Closing the action

So what does this ask of the person closing a corrective action? The FDA asked the Philadelphia company to “explain how you intend to assure your commitments are fulfilled and corrective actions are effective and sustainable,” and asked the New Jersey plant for its “process for evaluating CAPA plan effectiveness.” In a 2010 thread, a member explained what they do when that proof is missing: “I would write a finding that they were not meeting the requirement for corrective action and used the recurring nonconformances as evidence.” The effect was “to move the finding from a department level to a company level.” The auditor in the calibration story found the answer in the shop, where nobody knew about the fix.

Which finding came back at your plant this year, and how was it closed the first time?

Sources

• Elsmar Cove forum, “ISO9001 Major for repeat issue.”: the calibration story, December 2025; “the SAME nonconformance in the SAME process,” January 2022.
• US FDA, Marc-Henri Winter, “Workshop: Grading Nonconformities,” MDSAP, December 5, 2018. Grading scale (GHTF/SG3/N19, 2012), repeat-occurrence rule, and the concerns raised about it.
• MDSAP AU P0027.007, “Post-Audit Activities and Timeline Policy,” effective November 21, 2022. The 5-day notice.
• FDA warning letter to National Chemical Laboratories, Philadelphia, November 8, 2023.
• FDA warning letter to Akorn, Inc., Somerset, New Jersey, June 13, 2019. Uses “management oversight,” without “executive,” in the multiple-sites sentence.
• The repeated-failures sentence in two more letters: Cohere Beauty, April 15, 2024; HTO Nevada, Inc. dba Kirkman, January 27, 2026.
• Elsmar Cove forum, “Definition of Repeat Audit Findings,” February 2015, posts #1, #2 and #7.
• Elsmar Cove forum, “Handling Repeated Non-Conformities when doing Layered Process Audits,” May 2010, post #4.