Nonconformity and corrective action

Plain-language summary

When something fails to meet an ISMS requirement — a control not applied, a policy breached, an audit finding, an incident revealing a gap — reacting to it, dealing with the consequences, finding and removing the cause, checking the fix worked and changing the ISMS if needed, with the records to show it.

What the clause is really asking

A nonconformity is a failure to meet a requirement — of the standard, of your own policies and procedures, or of your SoA. Sources include internal and external audits, incidents (which almost always expose a nonconformity in a control), monitoring results, supplier failures and staff reports. The clause lays out the sequence: react to the nonconformity by controlling and correcting it and dealing with the consequences; decide whether action is needed to remove the cause so the problem neither comes back nor appears somewhere else — by reviewing the nonconformity, finding its causes and checking whether similar ones exist or could arise; implement the action; review its effectiveness; and make changes to the ISMS if necessary. Corrective actions must be appropriate to the effects of the nonconformity, and documented information must be available on the nature of the nonconformities and actions taken and on the results of corrective action. The discipline is the same one 8D and ISO 9001's 10.2 teach: containment first, then cause, then prevention, then verification. For incidents involving personal information, the reaction step includes POPIA section 22 notification.

What auditors look for

Auditors sample nonconformities from audits and incidents and follow each through the sequence: what was the immediate correction, what consequence was dealt with (including notification where personal data was involved), what cause analysis was done and does the cause explain the symptom, were similar occurrences checked, what action was taken, and how and when was effectiveness verified? They look for repeat findings — the same nonconformity in consecutive audits means the cause was never found — and for corrective actions proportionate to impact. They check the records are complete and that systemic causes led to changes in the ISMS, not just in the one instance.

Typical evidence

Nonconformity and corrective action register; nonconformity reports stating requirement, evidence and gap; correction and consequence records (including breach notifications where applicable); root cause analysis records (5-Why, Ishikawa, 8D where used); check for similar nonconformities; corrective action plans with owners and dates; effectiveness verification records; resulting changes to ISMS documents or controls.

How to comply — recommendations

Run one corrective action register for the ISMS, fed by audits, incidents, monitoring and staff reports, with the sequence as columns: correction, consequence, cause, extent check, action, verification, ISMS change. Write nonconformities as requirement, evidence, gap — the Qlause NC Writing Checklist method — so the cause analysis has something precise to work on. Scale the method to the effect: a 5-Why for a missed access review, an 8D for a ransomware incident. Verify effectiveness after a defined interval with evidence, not a signature. Use the Audit Manager to drive each finding to verified closure.

Common nonconformities

Nonconformities corrected but causes never analysed; root cause stated as 'human error' with no deeper analysis; no check for similar nonconformities elsewhere; corrective actions not verified for effectiveness; repeat findings audit after audit; incidents not treated as nonconformities of the control that failed; records incomplete; ISMS not changed when a systemic cause was found; POPIA notification duties missed in the reaction step.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Article8D problem solving explained: the 8 disciplines, root cause analysis and a free template
• ArticleHow to write an ISO 9001 audit nonconformity that won't get thrown out
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Toolkit · $29Incident & Breach Response KitWhen something happens the questions arrive faster than the facts: is it an incident, how bad, is it a POPIA breach, who must be told and by when, what do we write, what do we keep. This kit answers them in order.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Toolkit · $298D Problem-Solving ToolkitThe full 8D method in one working workbook: a D0–D8 report with Is/Is-Not, the three-legged 5-Why and an Ishikawa canvas built in — you fill the fields, not the theory.
• Free downloadNC Writing ChecklistWrite audit nonconformities that hold: requirement, evidence, statement — in that order, checked before the finding is issued.
• Free masterclass · ~14 min8D Problem-Solving MasterclassAll nine disciplines D0–D8 in plain English — three-legged root cause analysis, Is/Is-Not, Ishikawa and the 5-Why, plus the mistakes that get 8D reports rejected.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.