ISO 27001/Chapter/10.1 Continual improvement

When nonconformities occur, the organization shall react, correct, address consequences, evaluate causes, implement corrective actions, review effectiveness, and update the ISMS as needed.

In operational terms: Fix causes, not symptoms—contain the issue, remove root causes, verify effectiveness, and update the ISMS to prevent recurrence.

Auditors will typically look for evidence that the organization:

a. Reacts to nonconformities, corrects them, and addresses consequences.

b. Determines root cause and implements actions proportional to risk and severity.

c. Reviews effectiveness and updates risks, controls, processes, and documentation accordingly.