Nonconformity and corrective action

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

If a nonconformity arises, the organization must respond to it and, as applicable, act to control and correct it and handle what follows from it; evaluate whether action is needed to remove its causes so it does not recur or arise elsewhere, by reviewing it, finding its causes and checking whether similar nonconformities exist or could occur; implement any action needed; review how effective the corrective action was; and change the ISMS if necessary. Corrective actions must suit the effects of the nonconformities. Documented information must be available as evidence of the nature of nonconformities, the actions taken and the results of corrective action.

How the 2020 guidance taught the audit

Auditors confirm that the organization reacts to failures to meet ISO/IEC 27001 or its own ISMS requirements (operational ones included) by identifying the nonconformity and taking action to control and correct it; that the handling determines whether the situation needs correcting, investigates causes and considers whether similar cases exist or could occur so that recurrence is prevented; that the response is evaluated for whether it achieved the intended result and the ISMS is assessed for changes needed to avoid similar nonconformities; and that records of nonconformities, actions and results are created and controlled as documented information under 7.5.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 edition moved nonconformity and corrective action to 10.2. The 2020 audit row was numbered A.7.1 against the 2013 10.1. The 2022 clause also asks whether the corrective action changed the risks and opportunities determined during planning.

Evidence an auditor asks for

• ImprovementNonconformity log with nature, correction, cause analysis and corrective action
• ImprovementEvidence that corrective action effectiveness was evaluated
• ImprovementRecords of ISMS changes arising from corrective action
• ImprovementMonitoring, audit and management review results that raised the nonconformities

The questions an auditor will ask

Ask for a nonconformity, the cause analysis, the action, the effectiveness check and any change to the risk plan.

Common gaps

• Correction made but cause never investigated
• No check for similar nonconformities elsewhere
• Corrective actions closed without effectiveness review
• Interested party security requirements breached without a nonconformity being raised

Prepare before the next audit

Test one closed nonconformity against the 2022 clause. Record the effectiveness check and the change to the ISMS.

Cross-references