A correction was applied to a nonconformity, but no corrective action followed. Three months later the identical nonconformity reappears. What does this outcome most clearly illustrate about correction versus corrective action?
- A.Correction addresses only the technical symptoms, so without a written report to the certification body the nonconformity is free to be reopened
- B.Correction addresses only the immediate instance, so without corrective action eliminating the cause the nonconformity is free to recur
- C.Corrective action ends the matter only when the auditor agrees, so without that sign-off the nonconformity is held open in the certification register
- D.Repeated correction proves the action effective only after three cycles, so without those cycles the effectiveness review has no value for the auditor
Why B is correct
This scenario is the textbook demonstration of the distinction: correction fixes the symptom for the moment, but only corrective action removes the underlying cause. Skipping corrective action predictably allows the same nonconformity to recur, as it did here.
Know someone studying for ISO 27001? Send them this one.