An ISMS coordinator closes a corrective action but the only record kept is a one-line note saying 'fixed.' An auditor states the documentation is insufficient. According to Clause 10.2, which information must the retained documented information cover?

• A.The audit criteria used, the sampling method followed, and the names of the lead auditors from the certification body
• B.The risk owner approvals, the treatment option chosen, and the residual risk accepted by management in writing
• C.The training records, the awareness test scores, and the attendance lists signed by each participant in the session
• D.The nature of the nonconformities, actions taken, and the results of any corrective action