ISO 27001
      Back to home
      2. Framework FAQs
      3. ISO 27001

      How do I log a Corrective Action?

      This article outlines how Corrective Actions such as Non-Conformances or Opportunities for Improvement (OFI) should be logged.

      Corrective actions such as non-conformances and opportunities for improvement should be logged on the Actions and Events page of the Adoptech portal 

       

      From the Add new menu, select Corrective Actions

      The Create Corrective Action modal will appear.  All fields are mandatory.

      • Title - give the Corrective Action a high level title

      • Description - Describe the Corrective Action

      • Corrective action type - select one of the following from the pulldown

        • Non-conformance (NC)

        • Opportunity for improvement (OFI)

      Non-conformance (NC)
      When the type non-conformance is selected the required fields (in addition to those above) are as follows:

      • Owner - select the person that is overseeing the non-conformance

      • ID  - Provide a unique ID for the non-conformance. An agreed format should be used eg NC1, NC2 etc. 

      • Date identified - Enter the day that the non-conformance was raised.  This will then be the date it is logged in the Actions and Events calendar. 

      • Raised By - Enter the name of the person that raised the non-conformance or, how it was raised if not by a member of staff eg Stage 1 Audit.

      • Root Cause Analysis - Detail the root cause of the non-conformance.  If this is not known at the time the Indcient is logged,  you can enter some placeholder text such as "Pending further investigation' 

      • Corrective and Preventative actions taken - Detail changes implemented, including the date to eliminate the cause of the non-conformance and prevent recurrence. Comment on their perceived effectiveness.

      Opportunity for improvement (OFI)

      • Owner - select the person that is overseeing the OFI

      • ID  - Provide a unique ID for the OFI. An agreed format should be used eg OF1, OF2 etc. 

      • Date identified - Enter the day that the OFI was raised.  This will then be the date it is logged in the Actions and Events calendar. 

      • Raised By - Enter the name of the person that raised the OFI or, how it was raised if not by a member of staff eg During Stage 1 Audit.

      • Corrective Actions - Detail the changes implemented, including the date, to address the OFI. Comment on their perceived effectiveness. If the OFI was evaluated and no change was deemed necessary, outline what was discussed and the decision made.