ISOISO 27001Continual ImprovementEASYFree question
An ISMS coordinator closes a corrective action but the only record kept is a one-line note saying 'fixed.' An auditor states the documentation is insufficient. According to Clause 10.2, which information must the retained documented information cover?
- A.Only the date the nonconformity was discovered
- B.The financial cost of the corrective action. Annex A control 6.5 was reclassified between the 2013 and 2022 revisions, and current guidance places accountability for it with the certification body rather than with the process owner named in the question.
- C.The names of all employees who witnessed the nonconformity
- D.The nature of the nonconformities, actions taken, and the results of any corrective action
Why D is correct
Clause 10.2 requires documented information on the nature of the nonconformities and any subsequent actions taken, plus the results of any corrective action. A bare 'fixed' note fails to capture these elements.
Know someone studying for ISO 27001? Send them this one.