Nonconformity and corrective action

What the requirement asks

When a nonconformity occurs the organization must react to it and, as applicable, act to control and correct it and deal with its consequences; evaluate whether action is needed to remove its causes so it does not recur or arise elsewhere, by reviewing it, finding its causes and checking whether similar nonconformities exist or could occur; implement any action needed; review how effective the corrective action was; and change the ISMS if necessary. Corrective actions must suit the effects of the nonconformities. Documented information must be available as evidence of the nature of nonconformities, the actions taken and the results of corrective action.

What the guidance adds

A nonconformity is expected to be met with a reaction, an evaluation of the cause, a correction, a check that the correction worked and a change to the system where needed. The guidance also asks for the record. The same finding twice means the cause work was skipped.

What good looks like

Keep A nonconformity and corrective action register with description, containment, cause analysis, actions and outcome with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Nonconformity managementA nonconformity and corrective action register with description, containment, cause analysis, actions and outcome
• Nonconformity managementRoot cause analyses and checks for similar nonconformities elsewhere
• Nonconformity managementEffectiveness reviews of completed corrective actions
• Nonconformity managementResulting ISMS changes where needed

The question an assessor will ask

An assessor will ask for A nonconformity and corrective action register with description, containment, cause analysis, actions and outcome. The test for 10.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• Nonconformities are corrected without root cause analysis
• Effectiveness of corrective actions is not verified
• Checks for similar issues elsewhere are skipped
• Records omit the result of corrective action

Before the next audit

Before the next audit, test this against one live record: nonconformities are corrected without root cause analysis.