Control 10.2Nonconformity and corrective action

When a nonconformity occurs, react to it — take action to control and correct it, and deal with the consequences. Then evaluate the need for action to eliminate the causes so that it does not recur or occur elsewhere: review the nonconformity, determine its causes, and determine whether similar nonconformities exist or could potentially occur. Implement any action needed, review the effectiveness of corrective action taken, and make changes to the ISMS if necessary. Corrective actions must be appropriate to the effects of the nonconformities encountered, and documented information is retained on the nature of the nonconformities and subsequent actions, and on the results.

Two parts, and the second is where most organisations stop early. Correction fixes the instance; corrective action addresses the cause. A record that says “access removed” has corrected something and identified no cause.

“Or occur elsewhere” is the requirement that turns one finding into an examination. One stale account raises a question about the joiners-movers-leavers process, not about one account.

How to put this in place

Problems will be found, so the project needs a standard route for fixing them and their cause. Where root cause is never recorded, the same finding returns.

Log every nonconformity from audits, incidents and complaints.
Correct the problem and deal with the consequences.
Find the root cause, check whether similar problems exist elsewhere, and decide the corrective action.
Carry out the action, check it worked, and change the ISMS if needed.
Report the log to the management review.

Evidence an auditor usually looks for: a log showing each nonconformity, correction, root cause, corrective action, owner, date and effectiveness check.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 5 (Check) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-16: the typical form, what auditors accept instead and the gaps they reliably find.
Certification Readiness Self-AssessmentExcel
A blocking item in the readiness assessment, which treats it as needing to be operating before a Stage 2 audit.
ISMS Gap & Remediation TrackerExcel
Audit nonconformities and their corrective actions can be recorded in the Gap Register, with an owner, a date and a check that the fix worked.
ISMS Internal Audit Programme & ProcedureWord
Stage 7 of the procedure: correction, root cause, corrective action and the effectiveness check, with a finding record.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.