ISOISO 27001Continual ImprovementEASYFree question
Distinguish correction from corrective action. Which pairing is accurate?
- A.Correction is raised by the internal auditor; corrective action is approved by the certification body after review
- B.Correction updates the Statement of Applicability; corrective action updates the risk assessment methodology
- C.Correction fixes the immediate problem; corrective action eliminates the cause to prevent recurrence
- D.Correction applies to minor findings; corrective action applies to major findings
Why C is correct
A correction addresses the detected nonconformity itself (the symptom), while corrective action targets the underlying cause to prevent recurrence. The two are distinct and both may be needed for the same nonconformity.
Know someone studying for ISO 27001? Send them this one.