10.2 Nonconformity and corrective action

If a nonconformity arises, the organization shall respond to it and, where relevant, act to contain and fix it and to handle what it has caused. It shall judge whether action is needed to remove the underlying causes so the problem does not come back or appear somewhere else, by examining the nonconformity, finding out why it happened and checking whether comparable nonconformities already exist or might arise. It shall carry out whatever action is required, check whether the corrective action worked, and amend the PIMS where needed. Corrective action shall be proportionate to the impact of the nonconformity. The organization shall keep documented evidence of what each nonconformity was, what was done about it afterwards, and the outcome of the corrective action.

Source: ISO/IEC 27701:2025, 10.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.