Nonconformity and corrective action (10.2)
The standard asks you to react, analyse the cause, act where needed and review effectiveness, keeping evidence of all of it. A breach is an incident; if it reveals that a control was not working, it is also a nonconformity.
Continual improvement (10.1)
Improvement is demonstrated through trends: fewer overdue requests, less time to decide whether to notify a breach, more processors reviewed on schedule.
Example
A fictitious accountancy firm finds during an internal audit that three access requests were answered after 40 days. The cause: they arrived in a generic inbox with no owner. The action: a single form with a deadline and an alert. Six months later, all were on time.
What an auditor usually asks for
- A nonconformity log with cause and action
- Dated verification of effectiveness
- Links between breaches, findings and actions
- Indicator trends in the management review
How to cover improvement in Kimobox
- 1Open the nonconformity from the breach, the audit or the overdue request.
- 2Require the root cause before moving on to corrective action.
- 3Schedule the effectiveness check for a later date.
The root cause is mandatory: a nonconformity is never closed with the correction alone.