Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If the auditor raises a major nonconformity, then what?

7 decision pointsThe pack behind this answer: ISO 27001 Implementation & Certification Readiness

Add to board memo

The short answer

Recommendation
Check the facts at the closing meeting and show any record the auditor did not see, but do not argue the grade. If the major stands, tell the executive sponsor at once, then correct the problem, find a root cause you can change, remove it everywhere it applies, and prove with new samples that it worked.
Reasoning
A major nonconformity means a requirement is not met at all, or a failure is widespread or repeated enough to put the ISMS in doubt. From a certification body it holds the certificate until the body has checked and accepted the correction; you cannot close its finding yourself. From your internal auditor it is a warning you can still act on, but treat it as a blocker. The response has four parts whoever raised it: correction, root cause, corrective action and an effectiveness check (IS-09). Findings that are patched rather than fixed tend to return at the first surveillance audit.
Considerations
  • The 2 working days to tell the sponsor, 10 working days to plan, 30 days to complete an internal major, 60 days for the effectiveness check and the typical 90 days a body allows are the pack's defaults. The certification body sets its own periods.
  • 'Human error' is never a root cause on its own. Two similar failures with different owners usually point to the process, not to one person.
  • If you cannot correct and evidence a certification body's major within its period, say so early and agree a further visit or a partial repeat of Stage 2.
  • An effectiveness check that fails twice goes to top management: the board or a committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartThe auditor raises a major nonconformityDecisionDo you hold a record the auditor did not see?StepShow it, with the facts, at the closing meetingDecisionDoes the finding still stand as a major?OutcomeRecord the outcome, and handle any minor on its own timetableStepTell the executive sponsor at onceStepCorrect the immediate problemStepFind a root cause the organisation can changeStepPlan the corrective action, and look for the same cause elsewhereDecisionWho raised it?DecisionCan you correct and evidence it within the body's period?StepSend the correction and its evidence to the bodyDecisionHas the certification body accepted the correction?OutcomeCertification can go ahead; keep the corrective action runningOutcomeAgree a further visit or a partial repeat of Stage 2DecisionWill the action be complete before your certification audit?OutcomeSponsor decides whether the audit date movesStepCheck it worked, with new samples from after the changeDecisionDid the effectiveness check pass?OutcomeClose it, and report it to the management reviewOutcomeTake it to top management

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 21 steps.

  1. Start

    The auditor raises a major nonconformity

    A major nonconformity means a requirement is not met at all, or a failure is widespread or repeated enough to put in doubt whether the ISMS does its job. Several minor findings in one area can be raised together as a major. From a certification body it stops or delays the certificate. The response follows the same four parts whoever raised it.

    In the pack

  2. Decision

    Do you hold a record the auditor did not see?

    The closing meeting is the moment to raise anything unclear or factually wrong, with evidence. Arguing about the grade rarely helps; showing a record the auditor did not see sometimes does. If you have nothing to show, or are not sure, accept the facts and move on to the response.

    In the pack

  3. Step

    Show it, with the facts, at the closing meeting

    Present the record and let the auditor decide. For an internal audit, the auditee may dispute the grade at the closing meeting. In the pack's default, the ISMS manager settles it on the evidence within 5 working days, or the executive sponsor where the ISMS manager is the auditee.

    In the pack

  4. Decision

    Does the finding still stand as a major?

    The auditor may withdraw the finding, regrade it, or keep it. Grade by effect on the ISMS: the question is whether the requirement is met and the ISMS works. If the answer is unclear, treat it as still standing.

    In the pack

  5. Outcome

    Record the outcome, and handle any minor on its own timetable

    A withdrawn finding needs only the record of why. A minor nonconformity still needs a correction and a corrective action plan. From a certification body, the plan is often due within 30 calendar days and the minor must be closed before the first surveillance audit. For an internal minor, the pack's default is corrective action complete within 90 calendar days and before Stage 2.

    In the pack

  6. Step

    Tell the executive sponsor at once

    The pack's internal audit procedure tells the executive sponsor of a major at once, and within 2 working days of the closing meeting at the latest. A certification body's major matters more, because it holds the certificate, so tell the sponsor the same way. The sponsor may need to release people or money to meet the deadline.

    In the pack

  7. Step

    Correct the immediate problem

    Fix what was found: the missing record, the leaver's account, the overdue review. Fix it at once where you can. The correction deals with this instance only; it does not stop the next one.

    In the pack

  8. Step

    Find a root cause the organisation can change

    Ask why until the answer is something you can change: a process step, a responsibility, a tool, a missing reminder. 'Human error' is never a root cause on its own. Two similar failures with different owners usually point to the process, not to one person.

    In the pack

  9. Step

    Plan the corrective action, and look for the same cause elsewhere

    The corrective action is the change that removes the cause, with an owner and a date. Check whether the same cause could produce the same failure elsewhere, and extend the action if so. The pack's default is a plan within 10 working days of the report. Log it in your gap tracker or corrective action log and follow it to completion.

    In the pack

  10. Decision

    Who raised it?

    The certification body and your internal auditor grade in similar words, but the consequences differ. The certification body's major holds the certificate until it has verified the correction. Your internal auditor's major is a warning you can still act on before the certification body arrives.

    In the pack

  11. Decision

    Can you correct and evidence it within the body's period?

    The certification body sets the period to correct a major and show evidence; the pack's typical figure is 90 calendar days. If the period runs out, part of Stage 2 may need to be repeated. If you cannot be sure the action will be done and evidenced in time, answer no and say so to the body early.

    In the pack

  12. Step

    Send the correction and its evidence to the body

    Send the correction, the root cause, the corrective action and records from after the change, so the certification body can verify it. It may need a further visit to do so. The certification decision follows once it is satisfied.

    In the pack

  13. Decision

    Has the certification body accepted the correction?

    The body verifies the correction itself; you cannot close its finding. If it asks for more evidence and there is time left in the period, provide it. If it does not accept the correction, or you do not yet know, plan for the next step now.

    In the pack

  14. Outcome

    Certification can go ahead; keep the corrective action running

    Keep the finding record with the root cause, correction, corrective action and verification. Findings that are patched rather than fixed tend to return at the first surveillance audit, so keep checking that the cause stays gone.

    In the pack

  15. Outcome

    Agree a further visit or a partial repeat of Stage 2

    Take it to the executive sponsor and agree the way forward with the certification body: a further visit to verify, or repeating part of Stage 2. Do not go into a repeat visit expecting the same major; move the date, with the body's agreement, if the fix needs longer.

    In the pack

    See also

  16. Decision

    Will the action be complete before your certification audit?

    The pack's default for an internal major is corrective action complete within 30 calendar days of the report, and before the Stage 1 date where there is one. Treat every internal major as a blocker: a certification body finding the same would normally stop the certificate. If you are not sure it will be done in time, answer no.

    In the pack

  17. Outcome

    Sponsor decides whether the audit date moves

    Take it to the executive sponsor with a proposal: move the Stage 1 or Stage 2 date, or re-plan. Move Stage 2 with the certification body's agreement rather than go in expecting a major nonconformity.

    In the pack

    See also

  18. Step

    Check it worked, with new samples from after the change

    After the action has had time to work, take new samples from the period after it and confirm the cause is gone. The check is done by the auditor or someone else independent of the action, never on the owner's word alone. The pack's default is within 60 calendar days of the action being complete.

    In the pack

  19. Decision

    Did the effectiveness check pass?

    If the cause is gone, the finding can close. If it is not, the root cause was wrong or the action did not reach it: reopen the finding with a new root cause. A check that fails twice is a sign the problem is bigger than the control owner can solve.

    In the pack

  20. Outcome

    Close it, and report it to the management review

    The auditor closes the finding on the evidence. The finding, its actions and the check go into the programme summary, which is an input to the management review. They are also the records a certification auditor samples for nonconformity and corrective action.

    In the pack

    See also

  21. Outcome

    Take it to top management

    The pack escalates an effectiveness check that fails twice to top management. Depending on how you are governed, that is the board or a committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board. They decide what it takes: more resource, a different owner, or a change to the process itself.

    In the pack

Practical checklist

  1. Raise any record the auditor did not see at the closing meeting, and let the auditor decide.
  2. Tell the executive sponsor at once if the major stands.
  3. Correct the immediate problem, at once where you can.
  4. Ask why until the root cause is something the organisation can change.
  5. Plan a corrective action with an owner and a date, and extend it wherever the same cause could act.
  6. For a certification body's major, send the correction, root cause, action and post-change records within its period.
  7. For an internal major, complete the action before your certification audit, or take a date change to the sponsor.
  8. Check effectiveness with new samples from after the change, and close or reopen the finding on that evidence.

Evidence to have ready

  • The finding record: requirement, what was found, evidence and facts agreed by the auditee.
  • The correction, root cause, check for the same cause elsewhere, corrective action, owner and due date.
  • Records from after the change that show the cause is gone, and who checked them.
  • For a certification body's finding: what was sent to the body, and its acceptance of the correction.
  • The programme summary and management review minutes that took the finding as an input.

Assumptions

  • The finding comes from an ISO/IEC 27001 audit: either your internal audit or a certification body's Stage 1 or Stage 2.
  • The periods shown are the CISO Times ISO 27001 pack's defaults. The certification body sets its own periods for its findings, and your own procedure may set different ones for internal findings.

Not covered here