Auditing ISO 27001 Clause 10: Corrective Action

Clause 10 has two sub-clauses: continual improvement, and nonconformity and corrective action. The second carries far more requirement text than the first, and is the more commonly overstated of the two. What 10.2 mandates is that the organisation evaluates the need to eliminate causes — not that it takes corrective action in every case.

The worked findings on this page are invented, and so are the organisations in them. They are written to show how a finding is built and graded, not to catalogue the findings you should expect.

What ISO 27001 Clause 10.2 actually says

Five steps, and the second is where most summaries go wrong.

• React to the nonconformity and, as applicable, take action to control and correct it, and deal with the consequences.
• Evaluate the need for action to eliminate the causes so that it does not recur or occur elsewhere — by reviewing the nonconformity, determining its causes, and determining whether similar nonconformities exist or could potentially occur.
• Implement any action needed.
• Review the effectiveness of any corrective action taken.
• Make changes to the ISMS if necessary.

Documented information is required on the nature of the nonconformities and any subsequent actions taken, and on the results of any corrective action. And corrective actions must be appropriate to the effects of the nonconformities encountered.

Read step two and step three together. The mandatory act is the evaluation; step three says “any action needed”, which may legitimately be none. An organisation that reviewed a genuine one-off, determined its cause, checked whether similar ones exist, concluded no further action was warranted and recorded that reasoning has conformed.

So the finding against a correction-only response is not “you did not take corrective action”. It is that there is no evidence the need was evaluated. That version survives being argued with; the other one does not.

Correction and corrective action in ISO 27001

Two terms that are routinely used as if they meant the same thing. Correction eliminates the detected nonconformity — the immediate fix. Corrective action eliminates the cause so the nonconformity does not recur or occur elsewhere, which usually requires establishing what the cause was.

Note the wording: does not recur. Not cannot. The standard does not promise a guarantee and neither should a finding.

The audit trail for ISO 27001 Clause 10

Get the nonconformity log. Every source: internal audits, previous external audits, incidents, management review actions, staff reports. An organisation that keeps them in four systems with no overall view has a documented information problem before you have read one entry.

Sample by outcome, not by date. Take the ones marked closed. Anything still open is a story in progress; a closed one is a claim you can test.

For each, ask four questions. Has the immediate issue been corrected? Was the need to eliminate the cause evaluated, and is that recorded? Was any action needed actually implemented — with objective evidence, not a promise? And was its effectiveness reviewed?

That last question is where most organisations fail. Accepting a corrective action plan on paper and never verifying it worked is not a Clause 10.2 conformity. Effectiveness is verified with fresh evidence produced after the action landed, not with the action’s own completion record. If the action was to retrain a team, the evidence is that team’s later output, not the attendance sheet. If it was to add an approval step to a workflow, it is a sample of transactions processed since, not the amended procedure.

ISO 27001 Clause 10.1, which is shorter and not empty

Continually improve the suitability, adequacy and effectiveness of the ISMS. Note that it comes first in the 2022 revision, ahead of nonconformity — a reversal from the previous edition and a small numbering trap.

It is hard to fail in isolation and easy to fail cumulatively. The evidence lives elsewhere: management review decisions that changed something, objectives that moved, opportunities acted on, a risk assessment that has evolved. An ISMS with no version history anywhere is not improving, whatever its policy says.

A worked ISO 27001 finding on Clause 10.2 d)

Kestrel Freight logs nonconformities from all sources in one register, assigns owners, and records causes and actions.

The same discipline applies to the evidence box here as to every other: what you were told goes in where it establishes how far the failure reaches, and your view of why it happened stays out. The Clause 8 page in this set works through that distinction on a worked finding. Here it is the quality manager’s account of the closure practice that establishes reach: it takes the finding beyond the eighteen entries sampled to how the register is run.

A worked ISO 27001 finding on Clause 10.2 g)

Redgate Utilities operates a corrective action process with recorded cause evaluation and effectiveness reviews.

Major or minor on ISO 27001 Clause 10

Grade on evidence and reach, as everywhere else — the test is set out in full on the Clause 8 page in this set. What is particular to Clause 10 is that the failures cluster at the end of the process rather than the beginning.

• Major territory: nonconformities not recorded at all; no evaluation of cause anywhere in the process; effectiveness never reviewed; closure on a promise as standard practice.
• Minor territory: records incomplete for some entries in a process that otherwise works; one closure without evidence; one cause evaluation not recorded.

One judgement worth stating. The same nonconformity recurring is evidence about the corrective action, not a second nonconformity in itself. Auditors sometimes raise both; the defensible finding is the one about the process that let it come back.

The same caution applies to the opportunity for improvement here, and rather more sharply: a Clause 10 failure written up as an opportunity for improvement is a failure nobody has to answer.

What ISO 27001 Clause 10 means for your own findings

Clause 10 is the clause you are relying on when you close one. An auditor evaluates a corrective action response twice: first whether the proposed action is appropriate to the cause, and later whether it was implemented and is effective. A plan that only addresses the symptom is rejected at the first stage.

A promise does not close a nonconformity. Major nonconformities normally require verification, by document review or a further visit, before a certification recommendation.

Frequently asked questions about auditing ISO 27001 Clause 10

Where to go next: more ISO 27001 Lead Auditor exam preparation

• Auditing Clause 8: operational planning and control
• Auditing Clause 9: monitoring, internal audit and management review
• The clause map: what each clause asks, on one page
• Where the evidence lives: clauses matched to records

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.