When something falls short of ISO 27001 or your own rules, clause 10.2 expects you to deal with the consequences and remove the root cause. Log it, find the cause, fix the cause, check the fix worked, and keep records. The results of corrective actions are a mandatory record.
Where nonconformities come from
Audits are the obvious source, internal and external. But reviews and incident reports also surface them: a missed access review, a late patch, an offboarding that skipped a step. The process needs a single place where these are logged, whatever their origin.
The six steps
- Identify the nonconformity through a process that detects and documents it.
- Evaluate it to understand impact and find the root cause.
- Take corrective action aimed at the root cause, for example a process change, training or a new control.
- Review whether the action was effective.
- Document the nonconformity, the action and the result.
- Tell the people affected, and train them if needed.
Fix the cause, not the symptom
The test of a good record is whether the same problem can happen again. Suppose a contractor kept access after leaving. Revoking that access fixes the instance. The corrective action is the change that stops it recurring, such as tying account removal to the offboarding checklist. Clause 10.2 also asks whether similar nonconformities exist elsewhere, so look at the other teams and systems that rely on the same process.
Records auditors ask for
The results of corrective actions are mandatory records, usually kept as corrective action forms. Auditors look for two things: that nonconformities are logged and their causes analysed, and that corrective actions were actually carried out and checked. A procedure for nonconformities is not mandatory, though many teams write one.
A form needs only a few fields:
- What happened and where it was found
- Root cause
- Action, owner and due date
- Effectiveness check and its date
- Closure
Checking effectiveness
This step is skipped most often. After the action is in place, wait long enough to see whether the problem returns, then record what you looked at. A closed ticket is not proof of effectiveness. A clean follow up sample is.
For how findings reach this process, see running an internal audit.
A worked example
Say an internal audit finds that three engineers missed annual awareness training. Correction: they finish the course this week. Root cause: the reminder went to a shared mailbox nobody owned. Corrective action: reminders now come from the learning platform to each person and their manager. Effectiveness check: next quarter, confirm nobody is overdue. Record all four parts on one form.
Quick check
Is a corrective action procedure mandatory?
No. The records of corrective action results are mandatory, but a written procedure is optional.
Do minor findings need root cause analysis?
Clause 10.2 applies to nonconformities in general. Size the effort to the issue, but record the cause for each one.
Sources
- ISO 27001 Clause 10.2 Nonconformity and corrective action
- List of mandatory documents required by ISO 27001
Last reviewed: 19 October 2026.
