# Clause 10.1: Nonconformity and corrective action

Determine opportunities for improvement and implement the actions needed to achieve the intended BCMS outcomes; when a nonconformity occurs, react to it and deal with its consequences, evaluate whether action is needed to eliminate the cause by reviewing the nonconformity, determining its causes and checking whether similar ones exist or could occur, implement whatever action is needed, review the effectiveness of the corrective action, and change the BCMS if necessary, with corrective action proportionate to the effects encountered and documented evidence retained of the nature of the nonconformities, the actions taken and the results.

Cloud: When a provider incident exposes a gap, the corrective action should fix the class of failure, not only the instance. The same missing export path usually serves several services.

Evidence: Nonconformity register with source, description and immediate correction; Root cause analysis records; Extent of condition check for similar nonconformities elsewhere; Corrective action records with an effectiveness review; Evidence of any resulting BCMS change.

Test: Trace one past provider incident to a corrective action that changed more than the one service.

Citation: ISO 22301:2019, clause 10.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.