Improvement
10.1
Nonconformity and corrective action
Determine opportunities for improvement and implement the actions needed to achieve the intended BCMS outcomes; when a nonconformity occurs, react to it and deal with its consequences, evaluate whether action is needed to eliminate the cause by reviewing the nonconformity, determining its causes and checking whether similar ones exist or could occur, implement whatever action is needed, review the effectiveness of the corrective action, and change the BCMS if necessary, with corrective action proportionate to the effects encountered and documented evidence retained of the nature of the nonconformities, the actions taken and the results.
What the baseline asks
Determine opportunities for improvement and implement the actions needed to achieve the intended BCMS outcomes; when a nonconformity occurs, react to it and deal with its consequences, evaluate whether action is needed to eliminate the cause by reviewing the nonconformity, determining its causes and checking whether similar ones exist or could occur, implement whatever action is needed, review the effectiveness of the corrective action, and change the BCMS if necessary, with corrective action proportionate to the effects encountered and documented evidence retained of the nature of the nonconformities, the actions taken and the results.
What it means when the service runs in the cloud
When a provider incident exposes a gap, the corrective action should fix the class of failure, not only the instance. The same missing export path usually serves several services.
Evidence an auditor or a customer asks for
- Nonconformity register with source, description and immediate correction
- Root cause analysis records
- Extent of condition check for similar nonconformities elsewhere
- Corrective action records with an effectiveness review
- Evidence of any resulting BCMS change
Common gaps in a cloud estate
- Correction recorded as corrective action, with the cause never examined
- Root cause stated as human error, which stops the analysis rather than completing it
- No extent of condition check, so the same failure recurs in a sister site
- Effectiveness review missing, so recurrence is the only test the action ever gets
- Action disproportionate to effect in either direction, over engineered or nominal
Done well, what the file shows
Done well, this clause leaves a nonconformity register with source, description and immediate correction that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Trace one past provider incident to a corrective action that changed more than the one service.