ISOISO 27001Continual ImprovementEASYFree question
After a Stage 2 certification audit raised one minor nonconformity, the certification body asks the organization to submit something within a set timeframe. What is the organization typically required to provide?
- A.A signed declaration from top management and a revised Statement of Applicability for the whole scope
- B.A repeat of the Stage 2 audit and a new risk assessment covering each site in the scope
- C.A corrective action plan with root-cause analysis and target dates for closure
- D.A reduced audit scope and a written request to the accreditation body for an extension of the certificate
Why C is correct
For a minor nonconformity, certification bodies usually require a corrective action plan including root-cause analysis and committed closure dates, with evidence reviewed later. A full re-audit is not standard for minor findings.
Know someone studying for ISO 27001? Send them this one.