Clause 10.2 sets out what closing a finding involves, and certification auditors check all four steps. Take a typical finding: the quarterly access review was missed twice.
- Correction. Fix the immediate problem: run the access review now and record it.
- Root cause. Find out why it happened. Here, the review was owned by the operations lead, who left in spring, and nobody took it over.
- Corrective action. Change what caused it: name a new owner, add a recurring calendar task, and add the review to the handover checklist for that role.
- Effectiveness. Show it worked: the next quarterly review happens on time, and that record goes into the log.
Each finding gets a line in a corrective action log with these four steps, the owner, the deadline and the date it was closed.
The usual weakness is stopping after step one. The missing review is done, the log says "closed", and a year later the same finding appears because nobody fixed the ownership gap. A repeat finding is one of the clearest signs to a certification auditor that corrective action is not working.
At certification, majors have to be closed with evidence before the certificate is issued. Minors can stay open at the external audit if the plan is credible and dated.