ISO 27001 clause 10.2 sets the sequence: react to the nonconformity, work out why it happened and whether it exists elsewhere, implement the action, review whether it worked and update the ISMS if needed. Fixing the single instance is a correction; corrective action deals with the cause.
Certification bodies expect a corrective action plan for every nonconformity raised at audit and evidence of closure at the next visit. See nonconformity.
Read more
Related terms
- Nonconformity
- A nonconformity is a failure to meet a requirement of a management system standard or of the organization's own documented management system.
- Major nonconformity
- A major nonconformity is an audit finding that a mandatory requirement is missing or has broken down, serious enough to block or suspend an ISO certificate.
- Minor nonconformity
- A minor nonconformity is an audit finding of a single lapse or partial gap against a requirement that does not undermine the management system as a whole.
- Internal audit
- An internal audit is an organization's own planned review of whether its management system or controls conform to its requirements and work as intended.