ISO 27001 practical guide
ISO 27001 Corrective Action
ISO 27001 corrective action addresses the cause of a nonconformity so it does not recur or occur elsewhere. A correction fixes the immediate condition; corrective action changes the underlying process, control or management arrangement. Closure should follow an effectiveness review, not merely action completion.
- Search intent
- Resolve nonconformities in a way that addresses cause and prevents recurrence.
- Guide area
- Audit
- Review status
- Practitioner reviewed
What this means in practice
“Human error” rarely explains why the management system allowed the error to produce a nonconformity. Examine triggers, interfaces, responsibilities, workload, system design and verification.
The depth of cause analysis should match significance and recurrence risk. Lightweight methods can work for simple issues; complex or repeated failures need broader investigation.
Step-by-step implementation
- Step 1. Control the immediate condition and its consequences.
- Step 2. Assess the nonconformity’s significance, scope and potential recurrence elsewhere.
- Step 3. Analyze underlying process and control causes using evidence.
- Step 4. Select actions proportionate to cause and risk.
- Step 5. Assign owners, resources and completion criteria.
- Step 6. Implement actions and retain objective evidence.
- Step 7. Review effectiveness after enough operating time, then close or reopen.
What to prepare
- finding criteria and evidence
- correction or containment record
- scope and recurrence assessment
- cause analysis and supporting data
- action plan and implementation evidence
- effectiveness criteria, result and approval
Documents, records and evidence
| Area or field | Example | Why it matters |
|---|---|---|
| Weak cause | Human error | Does not explain system conditions |
| Better cause | Termination notifications rely on manual email and no reconciliation exists between HR departures and active directory accounts | Identifies process dependency and missing verification |
| Correction | Disable the sampled former employee account | Resolves immediate condition |
| Corrective action | Automate the HR trigger, add daily exception reporting and monthly reconciliation | Addresses cause and broader recurrence |
| Effectiveness | Three-month reconciliation shows all departures disabled within target | Verifies sustained result |
Correction versus corrective action
If a backup restoration test fails, rerunning the test after repairing one job is a correction. Investigating why failures were not detected, improving monitoring and escalation, updating ownership, and verifying several later restorations is corrective action.
Build a corrective-action record that proves the issue was resolved
A corrective-action record should tell one coherent story from detection to verified closure. It does not need to be a stand-alone form, but the audit trail must preserve the decisions, owners, evidence and dates. A ticketing system, audit platform or controlled register can all work when the fields below remain connected.
| Record element | Decision to capture | Evidence to retain |
|---|---|---|
| Source and requirement | Where the issue was detected and which criterion was not met | Audit evidence, monitoring result, incident record or complaint |
| Immediate correction | How the detected condition and its consequences were controlled | Changed configuration, corrected record, containment approval or service ticket |
| Extent assessment | Whether the same condition or cause could exist in other teams, systems or locations | Population query, sample results and scope decision |
| Cause analysis | Which process, interface, resource or control condition allowed the issue | Interviews, process data, event timeline and analysis notes |
| Selected action | Why the action addresses the established cause and is proportionate to risk | Approved plan, owner, resources, due date and acceptance criteria |
| Implementation | What changed and whether affected people and systems adopted it | Release record, revised workflow, communication, training or configuration evidence |
| Effectiveness review | What later result would demonstrate that the cause no longer produces the failure | Dated follow-up sample, trend, repeated test or recurrence review |
| Closure | Who accepted the result and any remaining risk | Approval, closure date, residual action and retained evidence references |
Choose an effectiveness test before closing the action
Completion and effectiveness are different decisions. Completion asks whether the planned change was delivered. Effectiveness asks whether the change removed or reduced the cause under normal operating conditions. Define the test while planning the action so the owner knows what evidence must exist before closure.
The waiting period should reflect the process cycle and recurrence risk. A daily identity reconciliation can produce useful evidence quickly. A quarterly supplier review may require a later sample. Where waiting creates unacceptable exposure, use interim monitoring or additional approval and keep the action open until representative evidence exists.
Pass, partial and fail examples
- Pass: a leaver-access failure is traced to a broken HR-to-IAM handoff; the trigger and exception report are implemented, and later samples show timely removal across the affected population.
- Partial: the workflow is revised and staff are briefed, but the effectiveness review tests only the original account or occurs before another process cycle.
- Fail: the account is disabled, the cause is recorded as “human error,” and the record closes without examining similar accounts or testing the revised process.
Sample corrective actions by risk, recurrence and change
Internal auditors should not select only the newest or easiest closed actions. Build a sample that includes significant findings, repeated issues, overdue actions, actions involving several departments, actions dependent on suppliers and records closed after major process or technology change.
For each sample, trace the original criterion, objective evidence, correction, cause, extent review, approved action, implementation evidence and later effectiveness result. Interview the process owner where the record does not explain why the action was considered sufficient.
Use the dedicated ISO 27001 Clause 10.2 guide for a clause-focused view. This page concentrates on the end-to-end workflow, record design and audit sampling needed to operate corrective action consistently.
What an auditor will look for
- Clear link from finding to correction, cause and selected action.
- Scope review covering similar processes, sites or systems.
- Objective completion evidence and accountable approval.
- Effectiveness criteria applied after a meaningful operating period.
An auditor may select different samples or follow unexpected evidence. Prepare authoritative records and owners who can explain normal operation, exceptions and improvement rather than rehearsed answers.
Common mistakes
- Renaming the correction as corrective action.
- Selecting retraining before establishing the cause.
- Closing an action on its due date without evidence.
- Ignoring whether the same weakness exists elsewhere.
Practical checklist
- □ Immediate consequences are controlled.
- □ Cause analysis uses evidence and examines the management system.
- □ Potential recurrence elsewhere is evaluated.
- □ Actions address identified causes and have accountable owners.
- □ Completion and effectiveness are evaluated separately.
- □ Closure is approved with retained evidence.
Frequently asked questions
What is the difference between correction and corrective action?
Correction fixes the detected condition; corrective action removes or reduces the cause to prevent recurrence.
Is root-cause analysis always required?
The organization must evaluate causes. Choose a proportionate method and depth based on significance, complexity and recurrence.
When can an action close?
After implementation evidence and a suitable effectiveness review support the closure decision.
Continue through the practical guide library
Use the topic hub to connect this task with related implementation, risk, governance, evidence and audit-preparation guidance.