ISO 27001 clauses
Fixing the symptom is step one. Clause 10.2 wants the cause.
Every ISMS produces nonconformities. Auditors expect that. What they test is what you do next: contain the problem, find out why it happened, change something so it does not come back, and check that the change worked. This page walks that path, from finding to verified close-out, and covers how certification-body findings are handled between audits.
Back to ISO 27001 services01 · What counts
What counts as a nonconformity
Any requirement not met: the standard's, a customer's, a law's, or your own.
If your policy says access reviews happen quarterly and one was missed, that is a nonconformity, even though the standard never mentioned quarterly. Many of the findings that matter most are against your own rules, because those are the commitments you made.
- Internal audit findings
- Certification audit findings
- Security incidents
- Missed metrics thresholds
- Customer complaints
- Failed control tests
- Staff reports
- Supplier failures
02 · Correction vs corrective action
Correction and corrective action are different jobs
The standard asks for both, and auditors notice when only the first was done.
Correction
Deal with this instance
- Disable the leaver's account
- Contain any harm
- Deal with consequences
- Done quickly
Corrective action
Stop it happening again
- Find the root cause
- Change the process, tool or training
- Check whether similar problems exist elsewhere
- Verify the change worked
Clause 10.2 also asks you to judge whether action is needed at all. A one-off with a known, trivial cause may need only correction. Record that judgement.
03 · Root cause
Finding the root cause
Two simple methods cover most ISMS findings.
- Five whys
- Ask why the problem happened, then why that happened, and keep going until you reach something you can change. Five is a guide, not a rule.
- Fishbone (Ishikawa) diagram
- Sort possible causes into branches such as people, process, technology, suppliers and environment, then test which ones the evidence supports. Useful when causes are tangled.
Illustrative: leavers keep their access
Finding: two leavers' accounts stayed active for over a week. Why? IT disabled them late. Why? IT heard about the exits days after the fact. Why? HR sends a monthly leavers list, not a notice per exit. Why? The offboarding procedure never set a notification step. Root cause: no trigger from HR to IT at the moment of exit. Corrective action: an HR system event that opens an offboarding ticket automatically on the exit date.
A root cause of human error is rarely the end of the chain. Ask what made the error easy to make.
04 · Verify and close
Verifying effectiveness and closing out
Closed means the cause is gone, not that the task was ticked.
- Agree in advance what evidence will prove the fix worked, such as the next three exits processed within the policy window.
- Wait long enough for that evidence to exist.
- Have someone other than the action owner check it.
- If it did not work, reopen the item and revisit the root cause.
- Update the ISMS where needed: procedures, risk register, training.
- Record the result and close, keeping the whole trail as documented information.
05 · Certification findings
Major and minor findings from the certification body
The certification body grades its findings, and the grade sets what must happen before it moves on.
| Major nonconformity | Minor nonconformity | |
|---|---|---|
| What it means | A requirement is not met in a way that puts the ISMS's ability to achieve its results in doubt | A lapse that does not on its own undermine the system |
| Effect at initial certification | Certification is not granted until it is resolved and verified | Certification can proceed once an acceptable action plan is in |
| Effect during surveillance | Can lead to suspension if not resolved in the time the body sets | Must be addressed; repeated or ignored minors can be raised to major |
| What you send | Correction, root cause and corrective action with evidence | Correction, root cause and a corrective action plan |
| How it is verified | Document review or a follow-up visit, at the body's choice | Usually at the next scheduled audit |
| Deadline | Set by the certification body, commonly weeks to a few months | Set by the certification body |
Between audits, treat certification-body findings exactly like internal ones: log them in the same register, run root cause, verify effectiveness. At the next surveillance audit the first thing the auditor checks is whether last time's findings are closed and stayed closed.
06 · Record template
A corrective action record template
One row per nonconformity, kept in a register or tracker.
| Field | What to record |
|---|---|
| Reference and date raised | Unique number and the date it was found |
| Source | Internal audit, certification audit, incident, metric, complaint |
| Requirement not met | Clause, control or internal rule |
| Description and evidence | What was found, with references |
| Correction taken | Immediate fix and containment, with date |
| Is further action needed? | Yes or no, with the reason |
| Root cause | The cause reached, and the method used |
| Similar issues elsewhere? | Where else it was checked, and the result |
| Corrective action | The change made, owner and due date |
| Effectiveness criteria | What evidence will show it worked |
| Verification | Who checked, when, and the result |
| Status and closure date | Open, in progress, verified, closed |
07 · Mistakes
Corrective action mistakes
Most repeat findings trace back to one of these.
- Correction logged as corrective action. The account was disabled, the item closed, and the next leaver kept access too.
- Root cause written as 'human error'. Nothing changes, so the same error repeats.
- Retraining as the default answer. Useful sometimes, but often a sign the real process cause was not found.
- Closing on the day the action is done. There is no evidence yet that it worked.
- Separate trackers for internal and external findings. Trends hide, and the management review sees half the picture.
- No check for similar problems. The fix lands in one team while the same gap stays open in another.
Sources: ISO/IEC 27001:2022, clause 10 (improvement) and sub-clauses 10.1 and 10.2, described in our own words; ISO/IEC 17021-1 for how certification bodies grade and follow up nonconformities, at a general level.
Questions about nonconformities
Is every incident a nonconformity?
No. Only when a requirement was not met.
An incident handled exactly as your procedure says is not a nonconformity. It becomes one when a control you committed to failed or was skipped, or when the response itself broke your rules.
How much detail does a root cause need?
Enough that the action clearly removes it.
Stop when you reach a cause you can change and that, once changed, would have prevented the problem. A paragraph is usually enough. A full fishbone is worth it for repeat or complex findings.
Can a minor nonconformity become major?
Yes, if it is ignored or repeats.
Certification bodies commonly raise a minor finding to major when it is not addressed by the next audit, or when several minors in one area point to a systemic failure. Check your body's own rules.
Who should verify that a corrective action worked?
Someone other than the person who made the fix.
The standard asks you to review effectiveness. Independence is not mandated for this step, but having the ISMS lead or internal auditor check, rather than the action owner, makes the evidence far more convincing.
Do observations need corrective action?
No, but they deserve a decision.
Observations and improvement opportunities are not nonconformities. Record whether you will act on each. An observation ignored for a year often returns as a finding.
Close findings so they stay closed.
Auditify can review your corrective action register, test root causes and help you prepare responses to certification-body findings. The certification body decides whether they are accepted.