Continual Improvement of an ISMS (Clause 10)
Improvement (10.1)
Continual improvement means enhancing the suitability, adequacy and effectiveness of the ISMS - deliberately, not accidentally. Inputs come from monitoring results, internal audits, management review outputs, incidents, nonconformities, changes in context, and identified opportunities. Improvement ranges from small tuning of a process to restructuring the risk treatment plan after a significant change.
Nonconformity and corrective action (10.2)
When a nonconformity occurs, the organization must:
- react - control and correct it, and deal with consequences (this is the correction);
- evaluate the need for action to eliminate the cause, so it does not recur or occur elsewhere - this may involve root cause analysis, checking whether similar nonconformities exist or could occur;
- implement the action required;
- review the effectiveness of the corrective action;
- update risks in planning if necessary;
- retain documented information on the nature of the nonconformity, actions taken and results.
The standard's corrective action process must be proportionate to the significance of the effects.
Traps. The classic error is confusing correction (fixing the symptom) with corrective action (removing the cause), and closing a finding with "retrained the operator" when no cause was investigated. Another trap is assuming Clause 10 equals handling nonconformities; improvement also covers opportunities, performance trends and proactive changes. Beware answers that say corrective action always requires a formal root cause method - the standard requires elimination of cause, and tools such as 5 Whys or Ishikawa are means, not mandates.
Rule of thumb. Test the action by asking: "If we removed the retraining and the reminder email, would the problem come back?" If yes, the cause was never eliminated and the nonconformity will recur.