ISOISO 27001Continual ImprovementEASYFree question
An ISMS coordinator closes a corrective action but the only record kept is a one-line note saying 'fixed.' An auditor states the documentation is insufficient. According to Clause 10.2, which information must the retained documented information cover?
- A.Only the date the nonconformity was discovered
- B.The nature of the nonconformities, actions taken, and the results of any corrective action
- C.The names of all employees who witnessed the nonconformity
- D.The financial cost of the corrective action
Why B is correct
Clause 10.2 requires documented information on the nature of the nonconformities and any subsequent actions taken, plus the results of any corrective action. A bare 'fixed' note fails to capture these elements.
Know someone studying for ISO 27001? Send them this one.