Nonconformity and corrective action

The requirement, in our words

When a nonconformity occurs, control and correct it, deal with the consequences, find the cause, check for similar cases, implement the action and review its effectiveness. Corrective action must fit the effects.

What it means for human oversight

A missed oversight review, an override that could not be exercised or a log that was not kept is a nonconformity. The corrective action must reach the cause, not just the instance.

How to evidence it

Attach the artefacts above to the Nonconformity and corrective action row with the system name, the owner and the date. The first one is the anchor: A nonconformity register with root cause analysis. The OH-17 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Corrective action records and effectiveness reviews. If that artefact for OH-17 cannot be produced, the row is a gap, whatever the policy says.

OH-17 carries 3 evidence items and 2 common gaps. For nonconformity and corrective action, the evidence is a dated record that the control operated, not a statement that it exists in a policy. The OH-17 statement above is ours, written from ISO/IEC 42001:2023, 10.2, not a reproduction of the licensed text.

Common gaps

• Corrections made without root cause analysis
• Effectiveness never reviewed

Related units

• Monitoring and measurement
• Internal audit
• Context and the role you play