Recurring certificate failures: correction is not corrective action
A payment processing company, Meridian Pay, had a severe outage in January caused by an expired TLS certificate. The incident record says “certificate renewed; monitoring improved.” The corrective action was closed in February after 30 days with no repeat. In April the same failure occurred on a different gateway; in July it happened again. Each time the team applied the fix and closed the ticket. The problem manager says the root cause is “human error” and proposes a reminder email. The SMS annual review is due, and the CEO wants to know why the same issue keeps appearing despite ISO 20000 certification. There is no trend report of recurring incidents, and change records show the certificate renewal process is manual and owned by a single engineer. The service manager is under pressure to show that corrective actions are effective before the annual review.
1. Evaluate how Meridian Pay has handled nonconformity and corrective action. What is missing?
Read the worked answer
Meridian has applied corrections-renewing certificates-but not effective corrective action. Corrective action requires determining the cause, evaluating the need for action, implementing it, reviewing effectiveness and updating risks or documented information. Closing after 30 days without recurrence is not proof when the same failure recurs on a different gateway after 45–90 days. “Human error” is a label, not a cause; the investigation should examine why a manual process with a single owner allowed expiry, why monitoring did not provide advance warning, and why the same design exists on multiple gateways. The reminder email is a weak action because it does not change the process. The recurrence itself is evidence that the previous corrective action was ineffective and should reopen the issue. Documented information should show the cause analysis, actions, owners, dates and effectiveness review.
2. What continual improvement actions would provide credible evidence to the CEO and certification body?
Read the worked answer
Credible improvement should start with trend analysis of incidents and changes to identify recurring failure modes, then a problem management record with a systemic cause. Actions could include automating certificate inventory and renewal, defining ownership with backup, adding expiry alerts to monitoring, testing renewal on all gateways, and updating configuration records. The improvement register should state the problem, action, owner, due date, measure and expected outcome. Effectiveness should be reviewed after a defined period, not assumed. Management review should use the trend, the reopened corrective action and the automation status to make decisions and allocate resources. That evidence addresses both the CEO's question and the certification body's interest in continual improvement, because it shows learning and changed controls, not just a repeated fix.