Section 20 discusses the submission of action plans and what the auditee should consider including in them. In addition, there are some guidelines as provided for auditors when evaluating those action plans. So if you have found a major or a minor nonconformity, the oddity needs to submit. An action plan. So there needs to be a couple of things in that action plan. So you need to of course describe the detected non-conformity The audity also needs to analyze the root cause of the detected nonconformity and the specific corrections and corrective actions taken or plan to be taken to treat the detected non-conformities within a defined period. So there are a couple of things. Root cause analysis, what was the reason? But you also need to think about corrections and corrective actions and the time period in which You need to implement it. So an action plan must be submitted for each nonconformity separately. So not one general action plan for all non-conformities together So if the audit's management um following the analysis and the root cause decides to accept the risk. Instead of implementing a corrective action, it must also justify the decision and document it appropriately. Action plans usually need to be submitted within a specific time frame and it also is dependent from certification body to certification body. Usually there's a deadline between 10 to 60 days If the action plan is not received within that specified time period, the audit will obviously not be recommended for certification. So looking at the content of that action plan, so there need to be a couple of things in there. So it's not necessary to submit a very detailed action plan and like cost involved firm selected project plan. So it's only a general statement uh regarding the actions that need to be taken. However, it needs to be a realistic action plan with timelines that are realistic. uh but also uh cost etc uh being included there as well. So if you need a s uh extensive budget you need to take that into account that you will probably not be able to implement the solution in uh in two months for example. So action plans can of course include the correction of the nonconformity. You uh should add a completion period. Um you want to add uh sometimes the obtainment of verifiable results so that it's Easy for the auditor to check if the results have been achieved, as well as the elimination of root causes. So on the following slide, you see an example of such an action plan. You see, it's very uh high level. So you get the number of the non-conformity, which is the same number if that you get from your auditor. Uh, the process that has been uh discussed is the information Security during disruption, which was clause A5. 29, and the first part you get from the auditor. The description of the non-conformity: there is no procedure in place to ensure the required level of continuity for information. security during an adverse situation such as a crisis or a disaster. This one you usually also get from your auditor because they need To describe it as well in their audit report. And then the root cause and the action plan is something that you need to come up with or that the organization needs to come up with. So the root cause in this case, the organization determined that there is a lack of personnel and management awareness. about the information security awareness and a decided on an action plan being the names of the persons to be contacted in case of a crisis or disaster must be listed in the information security continuity plan that will be done immediately and the procedures to contact these persons must be documented and communicated So uh an auditor receives obviously um the action plans uh back. Um so the auditor then needs To reassess or evaluate the project's plan, and that's based on their experience and knowledge, if the action plan that was submitted is appropriate and will address the root cause of the non-conform. So, first of all, the LDT must inform the auditor about the completion status of the corrections and the corrective actions. So usually you get that timeline you need To send the action plan back and the auditor receives it, then the auditor takes some time to have a look at the root cause analysis, the timelines, the corrective actions. And then, of course, it's very important to remember, depending on the number of non-conformities. that an audit has resulted in. Not all the corrections and corrective actions have to be implemented immediately. So as an auditor, it is also not a right expectation to think that everything will happen at the same time. So um every improvement basically requires the necessary resources and time for the implementations. So you can decide as an organization and you You should do that as um to um prioritize basically the action plans, um especially those that require investment. Sometimes you need to wait for the next budget round. So um the auditor also needs To check based on the timelines and the context of the IDT of the action plans are realistic So short summary, action plans must describe the detected nonconformities, the root causes of the detected nonconformities, and the specific corrections taken or planned to be taken. If action plans are not submitted within the specified deadline, the audit is not recommended for certification, and the auditor should also evaluate if the action plans are appropriate and address the root causes of the non-conformity.