ISO 27001 · the corrective action record
The corrective action record, written in the order of Clause 10.2
A nonconformity that was fixed but not recorded is, to an auditor, one that was not handled, so this page writes the record Clause 10.2 wants for one finding: what was found, the correction, the cause, whether it exists elsewhere, the action with an owner and a date, the check that it worked, and the change to the system.
The record
Every section the clause asks for, in its order; an empty entry is written as a gap to fill, not skipped.
# Nonconformity and corrective action record [reference], [company] Raised on [to be completed]. Found by: Internal audit. Requirement concerned: [to be completed]. Status: Open. This record follows Clause 10.2 of ISO/IEC 27001:2022 for one nonconformity: what was found, the correction and its consequences, the cause, whether the same problem exists elsewhere, the corrective action, the check that it worked, and the change to the management system that followed. Written on . ## 1. The nonconformity [to be completed] ## 2. Correction and consequences Correction: [to be completed] Consequences dealt with: [to be completed] ## 3. The cause Method: Five whys [to be completed] ## 4. The same problem elsewhere The records and the arrangements concerned were checked; no similar nonconformity exists or is expected elsewhere. ## 5. Corrective action [to be completed] Owner: [to be completed]. Due by: [to be completed]. ## 6. Effectiveness check Checked on [to be completed]. How: [to be completed]. Result of the check: [to be completed when the check is done; the record is closed only once the action has been shown to work] ## 7. Change to the management system No change to the management system is needed; the existing arrangements hold once the action is complete. Status: Open. The record is retained as documented information: the nature of the nonconformity, the actions taken and their results. This record is written from the entries given. It is not certification advice; the certification body reads corrective action records for the cause found, the action taken and the proof that it worked, and the record it accepts is the one the company signs off.
In StandardOS the nonconformity opens itself
An audit finding, a failed check or an incident opens a nonconformity with the correction, the cause, the action, the owner and the verification as fields, the due date tracked, and the management review picking up the open ones by itself.
The internal audit programmeThe management review minutesThe Annex A controls