ISO 42001 Clause 10.2: Correct AIMS Nonconformities and Address Their Causes

What clause 10.2 requires in practice

Clause 10.2 prescribes a response sequence when a nonconformity occurs. The organisation first reacts: it takes action to control and correct the problem and deals with its consequences, as applicable. It then considers whether action is needed to remove the underlying cause or causes, so the problem does not recur or arise elsewhere. That evaluation has three parts: reviewing the nonconformity, determining its causes, and determining whether similar nonconformities exist or could potentially occur.

Next the organisation implements any action needed, reviews the effectiveness of corrective action taken, and amends the AI management system where that proves necessary. Corrective actions are to be in proportion to the effects of the nonconformities. Documented information must be kept as evidence of what the nonconformities were, what was done afterwards and what the corrective action achieved. Correction and corrective action are therefore distinct steps.

Why clause 10.2 matters to the business

How an organisation handles its own failures says more about its maturity than the absence of failures. A rapid fix that leaves the cause untouched invites repetition, often in a different team or on a larger scale, and each recurrence costs time, money and credibility. A clear corrective action process helps managers see patterns, such as a shared workflow that bypasses review by default. It also gives clients and auditors confidence: they can see the problem, the investigation, the action and the proof that it worked. Avoiding blame-heavy language such as human error encourages staff to report problems early, which is the cheapest time to resolve them.

How to implement clause 10.2

Keep the response proportionate but complete from correction to effectiveness review. The following sequence is one that Sterling teams apply, and no single analysis technique is required. Scale the depth of investigation to the effect of the problem, and write down why you chose that depth.

1. Describe the nonconformity in specific terms, naming the requirement not fulfilled and the evidence observed.
2. Contain the issue and address its consequences, for example by restoring the intended route and checking affected work.
3. Investigate causes with an appropriate method, considering information, tools, workload, incentives, competence and authority.
4. Search for the same cause in other projects, services, sites and document types before deciding the scope of action.
5. Choose corrective action that fits the cause, using training only where a capability gap is actually involved.
6. Set the evidence that will show effectiveness, then review it before closing the item and reopen the action if the result is not achieved.
7. Update the AIMS and feed the lesson into risk assessment and management review where relevant.

Establish the requirement and evidence

Illustrative IT example: a change bypasses assessment

Illustrative construction example: the same cause exists elsewhere

A construction consultancy finds that an AI-generated project summary was issued without the required professional review. Investigation shows that the shared document workflow marks all generated drafts as approved by default.

The organisation examines whether the same configuration affects other projects and document types. Fixing the one summary is necessary but insufficient if the cause remains elsewhere. The response considers consequences, corrects the arrangement and verifies that the intended review now occurs under actual working conditions.

Evaluate causes without defaulting to blame

The clause requires review of the nonconformity, determination of causes and consideration of whether similar problems exist or could occur. Choose investigation depth appropriate to the effects. No universal cause-analysis technique is prescribed.

Examine the conditions around the action: information, workload, tools, incentives, competence and authority may contribute. Training is suitable when a capability gap is a cause. It will not solve an interface that hides the required information or a target that makes the control impractical.

Distinguish implementation from effectiveness

Action completion shows that something changed. Effectiveness review asks whether the response addressed the cause and achieved the intended result. Define suitable evidence before closing the action.

For the IT example, a revised form can be checked against subsequent changes and difficult cases. For the construction example, sampled workflow records and staff practice may reveal whether review can still be bypassed. These are illustrative methods; evidence should fit the actual cause and consequences.

Document the response and update the system

Required evidence includes the nature of nonconformities, actions taken and corrective-action results. Keep the relationship between the original problem, cause, response and effectiveness understandable. Where results show the response did not work, reconsider it rather than use administrative closure to conceal uncertainty.

If the AIMS needs change, coordinate it through planned change. Findings may also inform risk assessment, operational treatment and management-review inputs. Avoid losing responsibility between separate incident, risk and corrective-action logs.

Common mistakes