# Clause 10: Improvement
Where Clause 9 is concerned with establishing the effectiveness and conformity of the ISMS, Clause 10 looks at the actions the organizations must take in response to the findings. Clause [Clause 10.1](../../../MoCs/ISO_27001_2022_10.1_MoC%20Continual%20improvement.md) states the requirement of continual improvement and [Clause 10.2](../../../MoCs/ISO_27001_2022_10.2_MoC%20Nonconformity%20and%20corrective%20action.md) Nonconformity and corrective action.

In case of an initial audit it may be hard for the organization to show proof of improvements being in place following the first management reviews, but they could point at how they're going to measure, what mechanisms they've got in place to respond, what improvements they have planned for the near future, and how they are going to track progress.

## Nonconformity and corrective action

[Clause 10.2](../../../MoCs/ISO_27001_2022_10.2_MoC%20Nonconformity%20and%20corrective%20action.md) talks about Nonconformity and corrective action. 

A non-conformity is the non-fulfillment of a requirement, either of the standard or the organization's own requirements, and the organization is required to react to that.

There's a distinction to be made between a correction, which is repairing the consequences of a problem, and a corrective action, which is finding the root cause and the situation that allowed this problem to arise, and creating a plan to address the causes and preventing the problem from reoccurring (called a Corrective Action Plan or CAP).

For example: an organization finds that a number of devices has not had software patches installed for over 6 months. Applying these patches as soon as possible is advised, but this a correction. A corrective action is finding the problems in the patching process and repairing them, improving the relevant monitoring process and clarifying the responsibilities.

As an auditor you will be looking for described non-conformities, a root cause analysis process, reports of root cause analyses having been conducted.

### Corrective action process

The corrective action process should include the following steps:

1. ﻿﻿**Identification and documentation** of the nonconformity: The persons responsible define and document the nonconformity and analyze its impacts on the organization.
2. ﻿﻿﻿**Analysis of the root causes**: The persons responsible determine the source of the nonconformity and analyze the root causes.
3. ﻿﻿**Evaluation of solutions**: The persons responsible develop a list of possible corrective actions and evaluate different action plans. At this stage, if the problem is significant or if the likelihood of reoccurrence is high, temporary corrective actions can be taken.
4. ﻿﻿﻿**Selection of solutions**: The persons responsible select one or more corrective actions to correct the situation and determine the improvement objectives. The selected solution must correct the problem and should also be able to avoid its reoccurrence.
5. **Implementation of corrective actions**: The persons responsible implement the corrective action plan that as approved and document all the actions described in the plan.
6. ﻿﻿**Follow-up on corrective actions**: The persons responsible check whether the new corrective processes are in place and effective.
7. ﻿﻿﻿**Review of corrective actions**: The persons responsible periodically evaluate whether the objectives are being accomplished based on the defined corrective actions and whether those actions remain effective over time.
