ISO 27001 nonconformities and corrective action: root cause to closure

A nonconformity is anything that doesn't meet a requirement: the standard, your own policies, a contract or the law. "The leaver's account wasn't disabled within the policy's one working day" is a nonconformity. So is "no restore test since March".

Finding them is normal and healthy. What auditors judge is how you deal with them.

Why it matters

This is clause 10.2 of ISO/IEC 27001:2022. In summary, when a nonconformity happens you must:

• React to it: control and correct it, and deal with the consequences.
• Work out whether action is needed to stop it happening again, by reviewing it, finding the cause, and checking whether similar problems exist elsewhere.
• Take the action needed, then review whether it worked.
• Change the ISMS if needed.
• Keep records of the nature of each nonconformity, what you did, and the results.

Nonconformities come from internal audits, external audits, incidents, complaints, monitoring and day-to-day work.

What an auditor looks for

• A log exists and is used, with nonconformities from several sources, not only audits.
• Correction and corrective action are both there. Fixing the instance (re-enabling the restore test) is correction. Stopping it recurring (adding a recurring task with an owner) is corrective action.
• Root causes are real. "Human error" on its own isn't a root cause; why the error was possible is.
• Effectiveness was checked, some time after the fix, with evidence.
• Nothing is closed early. Open items are honest about their status.

Common reasons it fails: nonconformities closed with no root cause or effectiveness check; the same issue recurring audit after audit; or a log that's suspiciously empty.

A worked example

Illustrative:

• Nonconformity: two of five leavers sampled still had active accounts a week after leaving (access control policy requires one working day).
• Correction: both accounts disabled the same day; sign-in logs checked for use after leaving (none).
• Root cause: HR's leaver notification went to a shared inbox that nobody owned.
• Corrective action: leaver notifications now raise a task for the IT lead, with a one-day due date; the HR checklist updated.
• Effectiveness review: three months later, all leavers sampled had access removed within a day. Closed.

Common mistakes, and how to keep it manageable

• Arguing about whether it counts. Log it and grade it; a minor nonconformity costs little to record and shows your system works.
• Stopping at correction. Always ask why it was possible, and fix that.
• Closing without checking. Set a date to check effectiveness when you raise the action.
• Copying the same issue into several logs. Link the nonconformity to its source (the audit or incident) rather than re-describing it.

How to do it in ClearIMS

1. Open Nonconformities and record each one, or raise it straight from an internal audit finding so the two stay linked.
2. Record the correction and the root cause, and plan the corrective action with an owner and a due date. ClearIMS emails the owner when it's due or overdue.
3. Review effectiveness. ClearIMS won't close a nonconformity until it has its correction, root cause, corrective action and effectiveness review.
4. Approve and report. A named person approves it, and trends feed your management review.

Related pages

• Internal audits: a main source of nonconformities.
• Incidents: another source, often the most urgent.
• Improvement log: for opportunities that aren't failures.
• Management reviews: where trends are reviewed.