Certification Findings Action Plan Template (ISO/IEC 27001)

Certification Findings Action Plan: [Organization name]

Action plan for responding to the findings a certification body (CB) raises in an ISO/IEC 27001:2022 + Amd 1:2024 audit: Stage 1, Stage 2, surveillance, recertification or a special audit. It applies clause 10.2 (nonconformity and corrective action) to external findings and follows the audit process that ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 set for certification bodies. It records each finding, the correction, the root cause, the corrective action, the evidence sent to the CB, the deadlines the CB set and the verification result. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Finding types and what each needs
3. Roles and deadlines
4. Findings log
5. Response method
6. Worked responses
7. Submission log
8. Verification and closure
9. Escalation, clarification and appeal
10. Size tiers
11. Records and evidence
12. References

1. Purpose and scope

This plan records how [Organization name] responds to the findings raised by [CB name] during the [audit type] audit of the ISMS defined in DOC-ISMS-002, held on [dates]. It exists to:

• keep every finding, from every auditor, in one controlled list that matches the CB report;
• make sure each nonconformity gets a correction, a root cause, a corrective action and evidence, in the format and by the dates the CB set;
• give top management a single view of what blocks the certification decision or threatens the existing certificate;
• feed the internal corrective action process (clause 10.2), the audit findings register and the next management review (clause 9.3).

The plan covers findings in the CB report only. Findings from internal audits, customer audits and incidents go to isms/audit-findings-register and compliance/capa-nonconformity. When an external finding repeats an internal one, link both records so the CB can see that the internal process failed to close it, and treat that as part of the root cause.

2. Finding types and what each needs

Certification bodies grade findings under ISO/IEC 17021-1:2015 and their own published rules. The labels below are the common ones; copy the exact terms your CB uses.

Each nonconformity needs four distinct elements. Do not merge them.

1. Correction: action to remove the detected nonconformity itself, for example performing the missed access review now.
2. Extent check: a search for other instances of the same problem in other systems, sites or periods, so the correction is complete.
3. Root cause: why the management system allowed the nonconformity, stated as a cause the organization can change.
4. Corrective action: change to the system that removes the root cause, with an owner, a due date and a measurable effectiveness criterion.

Clause 10.2 also asks the organization to review whether similar nonconformities exist or could occur, to review the effectiveness of the action, to update risks and opportunities if needed, to change the ISMS if needed, and to keep documented information on all of it. The response method in section 5 covers each of these points.

3. Roles and deadlines

3.1 Roles

R responsible, A accountable, C consulted, I informed.

3.2 Deadlines set by the CB

ISO/IEC 17021-1:2015 places an outer limit on initial certification: if the CB cannot verify the corrections and corrective actions for every major nonconformity within six months after the last day of Stage 2, it must conduct another Stage 2 before recommending certification (as explained in European co-operation for Accreditation (EA) guidance on the standard; confirm the period in your CB's rules). The CB's own deadlines are usually much shorter. Plan to the CB's dates, not to the outer limit.

4. Findings log

Example summary for this audit: 8 findings in total, 1 major, 3 minor, 4 OFIs. All 4 nonconformities must have accepted responses before the certification decision, and the major one must also be verified.

5. Response method

5.1 Correction and extent check

Correct the instance the auditor found first: it shows control and reduces risk at once. Then search for the same problem elsewhere. Define the search before running it: which population (all leavers in the last 12 months, all suppliers, all on-call engineers), which source (HR system, finance records, rota), and who ran it. Record the result even when nothing else is found, because "no other instances" is a statement the CB may test.

5.2 Root cause analysis

Use a method proportionate to the grade. For minors, five whys is usually enough. For majors, combine five whys with a cause categories review (process, people and competence, tools, information, management oversight, supplier). A useful root cause:

• names something in the management system (a process step, a control design, an ownership gap, a missing trigger, a tool limitation);
• explains every instance found in the extent check;
• is something the organization can change.

Reject these as root causes: "human error", "oversight", "lack of time", "the employee did not follow the procedure". They describe what happened, not why the system allowed it. Ask the next "why".

5.3 Corrective action and effectiveness criterion

Each corrective action needs an owner, a due date that respects the CB deadline, the evidence that will prove implementation, and an effectiveness criterion stated in advance (for example "next two quarterly access reviews complete on time with zero leavers holding access after day 1"). Where the root cause touches risk, update the risk register (compliance/risk-register); where it touches a control decision, update the SoA (compliance/statement-of-applicability); where it touches a document, raise a change under the documented information process (DOC-ISMS-028).

5.4 Response quality checklist

Before management approves a response, confirm:

• The finding wording matches the CB report exactly.
• The correction is complete and evidenced with dated records.
• The extent check population, source and result are stated.
• The root cause passes the three tests in 5.2.
• Each corrective action addresses the root cause, not only the symptom.
• Owners and dates are realistic and inside the CB deadline.
• Effectiveness criteria are measurable.
• Risk register, SoA and documents are updated where affected.
• Evidence files are named, dated and free of unnecessary personal data.

6. Worked responses

6.1 CBF-2027-01, major (Example)

6.2 CBF-2027-02, minor (Example)

7. Submission log

Both submission deadlines in the Example were met: the plan was sent on 2027-05-26 against a 2027-06-11 deadline, and the major evidence on 2027-06-02 against a 2027-08-10 deadline. In the Example, the CB's certification decision followed on 2027-06-15.

8. Verification and closure

A finding moves through these states. Record the date of each change in the findings log.

• CB acceptance: the CB accepts the correction, root cause and plan. For minors this is usually enough for the certification decision.
• CB verification: for majors, the CB checks implementation evidence or visits. Keep the verification statement or report.
• Internal effectiveness review: after the effectiveness period, the ISMS manager or internal audit checks the criterion. If it fails, reopen the finding, repeat the root cause analysis and tell the CB before the next audit.
• Next audit check: at the next surveillance the CB reviews the actions taken on previous nonconformities. Prepare a one-page status for each in isms/surveillance-readiness-health-check.

9. Escalation, clarification and appeal

Keep every escalation in the submission log. An unanswered extension request is not an extension.

10. Size tiers

11. Records and evidence

Map each record in isms/control-evidence-matrix (DOC-ISMS-033) under clause 10.2 and, for findings against controls, under the control concerned. Under clause 10.2 an auditor will want to see, for each finding, what went wrong, what you did about it and whether the fix worked; this plan and the linked records give that trail for external findings.

12. References

Related templates: isms/audit-findings-register (DOC-ISMS-086), compliance/capa-nonconformity (DOC-ISMS-087), isms/stage-1-readiness-pack (DOC-ISMS-091), isms/stage-2-audit-evidence-index (DOC-ISMS-092), isms/certification-cycle-plan (DOC-ISMS-094), isms/surveillance-readiness-health-check (DOC-ISMS-096), isms/continual-improvement-register (DOC-ISMS-088), compliance/risk-register (DOC-ISMS-016), compliance/management-review (DOC-ISMS-085).

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clause 10.2 and with the certification audit process in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. The text, grading descriptions, examples and guidance are original. No ISO or IEC text is reproduced; read the official standards (purchase or licensed access from ISO, IEC or your national standards body) and your certification body's rules before relying on any statement here. Check the current edition of each standard and your CB's current deadlines before use. Certification decisions are made only by the accredited certification body. This is a documentation format, not certification or legal advice. Template licence: MIT.