[{"data":1,"prerenderedAt":14},["ShallowReactive",2],{"article:en:the-iso-27001-corrective-action-record-what-clause-10-2-asks-for-the-seven-sections-an-auditor-accepts-the-mistakes-that-reopen-a-finding-and-a-page-that-writes-it":3},{"locale":4,"slug":5,"title":6,"description":7,"published":8,"answer":9,"body":13},"en","the-iso-27001-corrective-action-record-what-clause-10-2-asks-for-the-seven-sections-an-auditor-accepts-the-mistakes-that-reopen-a-finding-and-a-page-that-writes-it","The ISO 27001 corrective action record: what Clause 10.2 asks for after a nonconformity, the seven sections an auditor accepts, the mistakes that reopen a finding, and a page that writes it","Clause 10.2 is what happens to a nonconformity once it is found: correct it and deal with what it caused, find the cause, ask whether the same problem exists elsewhere, act so that it does not recur, check that the action worked, change the management system where the cause lived, and keep the nonconformity, the actions and their results as documented information. A record an auditor accepts has seven sections in that order, separates the correction from the corrective action, and stays open until the check shows the action worked. A free page writes the record from the finding, the correction, the cause, the action with its owner and date, and the effectiveness check.","2026-09-13",{"who":10,"when":11,"do":12},"The person who owns the ISO 27001 management system in a company, and whoever is handed a finding to close: an internal audit, a certification audit, an incident or a failed check produces a nonconformity, and Clause 10.2 says what has to happen to it and what has to be written down.","Each time a nonconformity is found, from the day it is raised to the day the check shows the action worked; before the certification audit for every finding of the internal audits, and before the surveillance audit for every finding of the last certification audit, since those are the records the auditor opens first.","Correct it and deal with what it caused, write the nonconformity down as evidence, find the cause with a method, ask whether the same problem exists elsewhere, decide an action in proportion to the effect with an owner and a date, check later that it worked and record the result, change the procedure or the risk register where the cause lived, and keep the record; the free page writes it in the clause's order.","\nA nonconformity is not the failure; it is the record of one. An internal audit finds a review that was not done, an incident shows a control that did not hold, a customer's questionnaire turns up a policy nobody approved, and ISO 27001 does not ask that none of this ever happens. It asks, in Clause 10.2, what the company does next, and it asks for the proof. The finding that gets fixed the same afternoon and never written down is, to the certification auditor, a finding that was never handled, and it reappears at the next audit as a second nonconformity about the first. This article reads the clause as a sequence, names the seven sections of a record an auditor accepts, separates the correction from the corrective action, lists the mistakes that reopen a closed finding, and points to the [free page](\u002Fiso-27001\u002Fcorrective-action) that writes the record in the clause's order from the finding, the cause, the action and the check.\n\n## What the clause asks for, as a sequence\n\nThe clause is short and it is a sequence. First, react: stop the problem and correct it where that is possible, and deal with whatever it has already caused. Second, look for the cause: review what happened, work out why the existing arrangement let it through, and ask whether the same or a similar nonconformity exists somewhere else or could. Third, act on the cause where action is needed, so that it does not come back here or appear there. Fourth, check afterwards that the action worked. Fifth, change the management system itself where the cause lived in a procedure, a role, a control or the risk register. Around these sits one sentence of proportion, that the action should match the effect of the nonconformity, and one requirement for records: what the nonconformity was and what was done about it, and what the corrective action achieved, kept as documented information under Clause 7.5. Two things follow from reading it this way. A record that has only the first step is half a record, because the clause spends most of its words on the cause and the check. And the last step is the one most often skipped: the cause is found, the action is done, and the procedure that allowed it is never changed, so the same finding returns a year later with a new number.\n\n## The seven sections of a record an auditor accepts\n\nThe record has seven sections, in the clause's order. One: the nonconformity, written as evidence and not as opinion, with what was found, where, when, by whom, and against which requirement of the standard or which control of the company's own statement of applicability. Two: the correction and the consequences, what was done at once to stop and fix the instance, and what it had already caused and how that was dealt with, the leaver's account removed and its use since the leaving date checked. Three: the cause, with the method used to find it, five whys or a cause and effect diagram or a plain review, and written as the reason the arrangement failed rather than as the symptom: not \"the review was missed\" but \"the review was assigned to a named person and nobody held it while they were on leave\". Four: whether the same problem exists elsewhere, because a cause of that kind rarely lives in one place, and the answer, checked and written down, either widens the action or records that the other places were looked at. Five: the corrective action, a change to the arrangement rather than another reminder, with an owner and a due date, and in proportion: a typo in a policy needs correction and a note, a missed access review on the production database needs the whole sequence. Six: the effectiveness check, with a date after the action and a way of checking that is evidence, the next two quarterly reviews completed inside the quarter and shown by the tracker, and a result line that stays empty until the check is done. Seven: the change to the management system, which document, which risk register entry, which control, and its re-approval, or a sentence saying that no change is needed and why. The record closes only when section six has a result, and it is retained with the status and the date.\n\n## Correction is not corrective action\n\nThe clause uses two words that the record must keep apart. The correction is what fixes the instance: the review done late, the account removed, the document approved. The corrective action is what changes the arrangement so that the instance does not recur: the review assigned to a role with a deputy and opened by the tracker on the first day of the quarter. A record that files the correction under corrective action, which is the commonest finding on findings, tells the auditor that the cause was never looked for, and the standard's own test is the question of recurrence: if the same thing could happen next quarter in the same way, only the correction has been done. The proportion sentence cuts the other way and matters as much: not every nonconformity needs a cause analysis, an action plan and a change to the system, and a company that runs the whole sequence on every typo produces a register nobody reads. The judgement, recorded in a line, is what the clause asks for, the effect of the nonconformity decides how far the sequence goes, and the auditor reads the line.\n\n## The mistakes that reopen a finding\n\nThe record closed on the day the action was done, with no check that it worked; the auditor asks for the evidence of effectiveness and there is none. The cause written as the symptom, so the action is a reminder and the finding returns. Nobody asked whether the same problem exists elsewhere, and the auditor finds it there. The action has no owner or no date, so the management review cannot report on it under Clause 9.3 and the next internal audit under Clause 9.2 finds it still open. The procedure that let it through was never changed, or was changed and never re-approved, so the documented information under Clause 7.5 contradicts the record. The findings of the certification audit were handled and the findings of the internal audits were not, or the reverse, because the two lived in different places. The record was closed by the person who owned the action, with nobody else looking. And no register, so nobody can say how many nonconformities were raised and closed in the period, which is the first of the four trends the management review reports. Each of these is avoided by writing the record in the clause's order and by leaving a section empty rather than skipping it, because an empty section is visible and a skipped one is not.\n\n## What to do with it\n\nEnter the finding on the [free page](\u002Fiso-27001\u002Fcorrective-action): the company, the reference, the date and where the finding came from, the requirement concerned, then the nonconformity, the correction and the consequences, the cause and the method, whether it exists elsewhere, the action with its owner and due date, how and when effectiveness is checked, and whether the management system changes. The page writes the record in the clause's order, with the facts of the record in the link and the free text kept on the page, and leaves the effectiveness result as a gap until the check is done. Copy it, have someone other than the action's owner close it, file it as the documented information of the nonconformity, and count it in the next management review. StandardOS opens a nonconformity from an audit finding, a failed check or an incident, with the correction, the cause, the action, the owner and the verification as fields, the due date tracked, and the management review picking up the open ones; the [internal audit programme](\u002Fiso-27001\u002Finternal-audit) is where most findings come from, the [management review minutes](\u002Fiso-27001\u002Fmanagement-review) are where they are counted, and the [Annex A controls](\u002Fiso-27001\u002Fcontrols) are where the requirement concerned is usually named.\n",1789383982896]