What must an organization do when a nonconformity is detected?
- A.React to it, take action to control and correct it, evaluate the need for action to eliminate the cause, and implement changes
- B.Document it in the nonconformity register, notify the auditor, and wait for the next surveillance visit to confirm closure
- C.Report it to top management, record the decision to accept it, and move on without any correction
- D.Correct the immediate symptom, close the record the same day, and skip the cause evaluation for minor items
Why A is correct
When a nonconformity is detected, the organization must react, control and correct it, evaluate root causes, implement corrective actions, and review effectiveness.
Know someone studying for ISO 27001? Send them this one.