A corrective action that only retrains people
Orion SaaS received a major nonconformity at surveillance: five of twenty sampled leavers still had active accounts 30 days after leaving, including one privileged account. The requirement cited was Annex A control A.5.18 (access rights). Orion's correction was to disable the five accounts. Its corrective action was: 'HR will email IT when someone leaves; IT has been reminded to action requests; all staff will receive security awareness training.' No root cause analysis was provided. Six weeks later, you verify effectiveness by sampling fifteen recent leavers: two still had active accounts, one a contractor. Orion says the sample is 'too small to be meaningful'.
1. Evaluate the correction and corrective action. What is missing?
Read the worked answer
The correction (disabling the five accounts) addresses the symptom. The corrective action does not address the cause.
A valid corrective action needs to show:
- root cause analysis: why leavers remained active - no automated HR-to-IT trigger, no reconciliation, unclear ownership for contractors, or no access review;
- action proportionate to the cause: for example, a defined joiner-mover-leaver process with evidence, reconciliation of HR records to directory accounts, and contractor onboarding/offboarding ownership;
- responsibility and dates;
- verification evidence, not just a training record.
'Remind' and 'train' are weak because they rely on memory and do not show the process is controlled. The absence of root cause analysis means Orion cannot know whether the same cause will recur. As auditor, I would not prescribe the fix, but I would reject the corrective action as insufficient and explain the requirement.
2. How would you verify effectiveness, and what would you conclude from the second sample?
Read the worked answer
I would define the population and sample before looking at results: all leavers and contractors in the period, including privileged accounts and transfers. I would select randomly or systematically, not from a list supplied only by the client, and compare HR termination dates with account disablement logs and access reviews.
Two active accounts out of fifteen, including a contractor, is a recurrence after the corrective action. The client's objection about sample size cuts both ways: a small sample cannot prove effectiveness, but a recurrence in a small sample is still evidence of failure. I would expand the sample if time allows and check whether the two cases were within the action's scope. Unless there is a clear explanation (for example, a different contractor process not covered by the action), I would conclude the corrective action is not effective, reopen the nonconformity and raise it as a major nonconformity.
I would record the sampling method, dates, evidence and the client's comments.
3. What are the certification implications, and what should the auditor avoid doing?
Read the worked answer
A major nonconformity that remains unresolved affects the certification decision. The certification body will require correction and verified corrective action within its defined timeframe; if that is not achieved, the certificate may be suspended or withdrawn in line with its procedures. I would report the failed verification to the decision function and not close the finding on a promise.
The auditor should avoid:
- designing the client's process or writing its procedure, which would become consultancy;
- accepting training records as proof of effectiveness;
- letting the client's commercial relationship with the certification body influence the severity;
- closing the finding without sampling evidence.
I can state the requirement and the type of evidence needed, and I can explain why the current evidence is insufficient. The client owns the solution.