If an internal audit, an incident or a complaint shows a nonconformity, then how do we correct it and stop it coming back?

Start

Something does not meet a requirement

It came from an internal audit, an incident or a complaint. The route is the same whatever the source, and the log should hold all three: the pack's checklist warns against logs that hold only audit findings. If a certification body raised it, its own deadlines apply and the route differs; see the linked question.

• Then: Is a requirement of the standard, your policy or a contract not met?

Decision

Is a requirement of the standard, your policy or a contract not met?

A nonconformity is a requirement not met. A weakness that breaks no requirement, or an idea that would make a control work better, is an observation. If you are not sure which, answer yes and let the auditor or ISMS manager grade it.

• Yes, or not known: Log it with its source, date and owner
• No: Record it as an observation and take it to the management review

Step

Record it as an observation and take it to the management review

Observations are recorded and considered at the management review, but not tracked as nonconformities. Bring them as improvement opportunities with a note of the effect expected.

• Then: Observation recorded: no corrective action required

Outcome

Observation recorded: no corrective action required

Keep the note. Do not downgrade a real nonconformity to an observation to avoid the work. The pack grades by effect, not by embarrassment.

Step

Log it with its source, date and owner

One log for all sources lets you see repeats. Record what happened, the requirement, the evidence and who owns the response.

• Then: Is it missed altogether, or widespread enough to doubt the ISMS?

Decision

Is it missed altogether, or widespread enough to doubt the ISMS?

The pack grades by effect: a major is a requirement not met at all, or a failure widespread or repeated enough to doubt the system. A minor is a partial lapse where the system still works. When in doubt between the two, take more samples.

• Yes, or not known: Tell the executive sponsor at once
• No: Correct the problem now and deal with the consequences

Step

Tell the executive sponsor at once

By the pack's default the sponsor hears of a major internal finding at once, and within 2 working days of the closing meeting at the latest. Treat every internal major as a blocker for the certification audit.

• Then: Correct the problem now and deal with the consequences

Step

Correct the problem now and deal with the consequences

Fix the immediate problem: the missing record, the leaver's account, the overdue review. A correction does not stop it happening again, so do not close the finding here.

• Then: Find the root cause: ask why until it is something you can change

Step

Find the root cause: ask why until it is something you can change

Keep asking until the answer is a process step, a responsibility, a tool or a missing reminder. 'Human error' is never a root cause on its own. The pack's default is within 10 working days of the report.

• Then: Set an owned, dated action; widen it if the cause acts elsewhere

Step

Set an owned, dated action; widen it if the cause acts elsewhere

The action removes the cause. Check whether the same cause could produce the same nonconformity elsewhere and extend the action if so. Enter it in the gap tracker or your own log. The pack's defaults for internal findings are 30 calendar days to complete a major and 90 for a minor. Make the action fit the size of the effects.

• Then: Is the action complete by its date?

Decision

Is the action complete by its date?

Check at each review of the log. An action past its date goes to the executive sponsor and is named in the monthly readiness review and the management review. If you are not sure it is finished, answer no.

• Yes: Check it with new samples taken after the action
• No, or not known: Escalate to the executive sponsor and name it in the review

Step

Escalate to the executive sponsor and name it in the review

Ask for a decision: resource, a new date with a reason, or a change to the action. An overdue corrective action counts as a gap overdue in the readiness measures.

• Then: Is the action complete by its date? (back to an earlier step)

Step

Check it with new samples taken after the action

After the action has had time to work, take samples from the period after it and confirm the cause is gone. The check is done by the auditor or someone else independent of the action, within 60 calendar days of the action being complete, the pack's default.

• Then: Does the check show the cause is gone?

Decision

Does the check show the cause is gone?

Read the new samples against the requirement. The same failure in the new period means the cause is still there. If the evidence is thin, answer no and take more samples.

• Yes: Close the finding on the check, and change the ISMS if needed
• No, or not known: Reopen it with a new root cause

Step

Close the finding on the check, and change the ISMS if needed

Never close a finding on the owner's word alone. If the cause sat in a process, a control or a risk, update that document or risk entry now. Then include the item in the report to the management review.

• Then: Report the log to the management review

Step

Reopen it with a new root cause

The first root cause was wrong or the action did not reach it. Go back to the cause with the new evidence, and set a new action.

• Then: Has the check on this finding now failed twice?

Decision

Has the check on this finding now failed twice?

Two failures mean the process is not able to fix this by itself. The pack escalates an effectiveness check that fails twice to top management.

• Yes: Take it to top management for a decision
• No: Find the root cause: ask why until it is something you can change (back to an earlier step)

Outcome

Take it to top management for a decision

Ask for resource, a change of design or an acceptance of the consequence. Do not tell a customer or a certification body that the problem is fixed until a check has passed.

Step

Report the log to the management review

Show nonconformities opened, closed, overdue and repeated, and the effectiveness checks passed. The review reads them with the audit results and the measures, and decides what needs action.

• Then: Closed on evidence: the log shows the whole route

Outcome

Closed on evidence: the log shows the whole route

An auditor can now trace one finding from its source to its closed check. Do not describe a finding as fixed on the correction alone. Your certification body's own findings follow its deadlines.