Nonconformity & Corrective Action: ISO 37001 and ISO 37301

Quick Read

Both ISO 37001 and ISO 37301 require organisations to react to nonconformities, determine their causes, check whether similar problems exist or could occur elsewhere, take corrective action, review whether that action worked, and keep documented evidence of all of it. ISO 37301 extends the same discipline to noncompliance with compliance obligations. Most compliance and legal teams are good at resolving problems and weak at closing them out: they fix the matter in front of them, but they rarely record it, rarely analyse why it happened, rarely ask where else it is happening, and rarely prove that the fix worked. This paper explains why nonconformity management must cover every source — not only findings raised by the certification body or internal audit, but anything discovered while operating the system — and sets out a ten-stage workflow, the documentation each stage requires, two worked examples, and what Speeki’s auditors look for.

Executive Summary

Lawyers and compliance professionals are trained to solve problems. When a gift is approved without the right sign-off, a due diligence file is found incomplete or a training population is missed, they act quickly, fix the matter and move on. In a legal practice, that is the job. In a management system, it is only the beginning.

Clause 10.2 of both ISO 37001:2025 and ISO 37301:2021 asks for something different. It requires the organisation to react to the problem, but also to determine why it happened, to determine whether similar problems exist or could occur elsewhere, to implement action that removes the cause, to review whether that action was effective, and to change the management system if necessary. It requires documented evidence of the nature of each nonconformity, the actions taken and the results. A problem that has been fixed but not analysed, extended, verified and documented has not been closed in the sense the standards intend.

Speeki sees the same weakness across many anti-bribery and compliance management systems. The nonconformity register — where one exists — contains only the findings raised by the certification body, and perhaps those from internal audit. The far larger stream of failures discovered through day-to-day operation of the system never enters it. Root cause analysis stops at “human error”. Nobody asks whether the same gap exists in other business units. Corrective actions are marked complete when the task is done, not when the problem has stopped.

This paper sets out what the standards require, what should enter the register, a ten-stage workflow from detection to closure, the documentation each stage should produce, two worked examples, and what Speeki’s auditors test. It builds on Speeki’s earlier whitepaper, Building a Non-Conformity Management System, which provides a template suite applicable across management system standards; this paper focuses specifically on anti-bribery and compliance management systems and on the people who run them.

1. What the Standards Require

ISO 37001:2025 and ISO 37301:2021 both follow ISO’s harmonised structure for management system standards, and both place nonconformity and corrective action in Clause 10.2. (In ISO 37001:2016, this requirement sat in Clause 10.1; the 2025 edition reversed the order of Clauses 10.1 and 10.2 to align with the harmonised structure.) The requirements are, in substance, the same in both standards.

1.1 What ISO 37301 adds: noncompliance

ISO 37301 applies Clause 10.2 to both nonconformities and noncompliances. The distinction matters. A nonconformity is the non-fulfilment of a requirement — of the standard, or of the organisation’s own management system. A noncompliance is the non-fulfilment of a compliance obligation — a law, a regulation, a contractual commitment, an internal policy the organisation has adopted. The standard notes that a nonconformity is not necessarily a noncompliance.

In practice, the two often travel together. A sanctions screening control that was not performed is a nonconformity with the organisation’s own procedure; if a shipment then went to a sanctioned party, there is also a noncompliance with a legal obligation. ISO 37301 requires both to be reacted to, analysed and corrected through the same disciplined process. Annex A.10.2 adds that the organisation should identify the root causes of failures to follow policies or procedures and update them based on the lessons learned, and notes that a single failure to prevent or detect noncompliance does not necessarily mean the system is generally ineffective.

1.2 The anti-bribery equivalent

ISO 37001 deals with actual or suspected bribery through its investigation requirements, and with failures of the anti-bribery management system through Clause 10.2. An attempted bribe that was correctly detected and refused is not, by itself, a nonconformity — the system worked. A bribe that was paid because a control did not operate, a red flag that was missed in due diligence, or a gift approved outside the policy are failures of the system, and they belong in the nonconformity process as well as in any investigation.

1.3 Correction is not corrective action

The single most important distinction in this paper is between correction and corrective action. ISO 9000:2015, the vocabulary standard for quality management, defines correction as action to eliminate a detected nonconformity, and corrective action as action to eliminate the cause of a nonconformity and to prevent recurrence. ISO 37301 uses the same definition of corrective action.

2. What Belongs in the Register

The most common structural weakness Speeki sees is a register that contains only findings raised by the certification body. Some organisations add internal audit findings. Very few capture the nonconformities their own system surfaces every week.

The standards do not limit Clause 10.2 to audit findings. They apply it “when a nonconformity occurs”. Any nonconformity discovered while operating the anti-bribery or compliance management system — by anyone, through any route — should give rise to an entry in the register.

2.1 The sources

A useful way to organise the sources is by the three lines model published by the Institute of Internal Auditors in 2020, with external sources alongside.

2.2 Why every source matters

Recording only external findings has three consequences. First, the organisation cannot demonstrate that its own system detects problems — which is the purpose of monitoring, internal audit and speak-up. Second, patterns are invisible: three “minor, fixed locally” failures in three countries may be one systemic weakness. Third, the certification audit becomes the organisation’s primary detection mechanism, which is the reverse of how a management system is meant to work.

2.3 What does not belong — and where it goes instead

Not everything is a nonconformity. Opportunities for improvement, suggestions and observations that do not identify an unfulfilled requirement should be recorded and considered, but they do not require root cause analysis or corrective action. The register should distinguish them clearly. Equally, an incident that the system handled correctly — an attempted bribe that was refused and reported — is evidence that the system works, not a nonconformity, although it may still be recorded for trend analysis.

3. The Ten-Stage Workflow

The workflow below translates Clause 10.2 into practical stages. Each stage has a defined output that is recorded against the nonconformity. Proportionality applies throughout: a minor documentation gap does not need the same depth of analysis as a systemic control failure, but every stage should be considered and the decision recorded.

1. Identify and raise. Anyone who finds a nonconformity raises it, using a simple route that is the same regardless of source.

2. Record. The nonconformity is entered in the register with a unique reference, the source, the date and a factual statement.

3. Assess and classify. The nonconformity is classified — nonconformity, noncompliance or both; severity; the requirement not fulfilled; the owner.

4. Contain and correct. Immediate action controls and corrects the problem and deals with its consequences.

5. Root cause analysis. The organisation determines why the nonconformity occurred, down to a cause that can be changed.

6. Extent analysis. The organisation determines whether similar nonconformities exist elsewhere or could potentially occur.

7. Corrective action plan. Actions are designed to remove the cause wherever it exists, with owners, resources and dates.

8. Implement. The actions are carried out and evidence of implementation is retained.

9. Verify and retest. After an appropriate period, someone other than the implementer tests whether the fix is in place and works.

10. Close and learn. The nonconformity is closed on evidence, the risk assessment and system are updated, and trends feed management review.

3.1 Stages 1 and 2: identify, raise and record

The quality of everything that follows depends on the quality of the first record. A good nonconformity statement has three parts, the same structure auditors use: the requirement, the evidence and the gap. It describes what was found, not what should be done about it.

The weak statements jump to a solution and lack the evidence needed for analysis. The strong statements give the analyst everything needed to understand the gap — and give the auditor a record that can be traced.

3.2 Stage 3: assess and classify

Classification determines the depth of response. At a minimum, record:

• Type: nonconformity with the standard, nonconformity with the organisation’s own system, noncompliance with a compliance obligation, or a combination.

• Severity: using the organisation’s own documented criteria. Speeki’s own approach as a certification body is to treat a nonconformity as major where a required activity has not been performed at all, and as minor where it has been performed but not adequately; ISO/IEC 17021-1 also notes that a number of minor nonconformities against the same requirement can demonstrate a systemic failure and constitute a major nonconformity. Organisations may use more granular internal scales, but should define them.

• Requirement: the clause of the standard, the procedure or the obligation not fulfilled.

• Owner: a named person accountable for taking the nonconformity through to closure.

• Escalation: whether the matter must be reported to top management, the governing body or a regulator. ISO 37301 Annex A.8.4 notes that organisations are sometimes legally required to report noncompliance to regulators.

3.3 Stage 4: contain and correct

Clause 10.2 requires the organisation to react: to control and correct the nonconformity and to deal with its consequences. Containment stops further harm — suspending payments to an intermediary, withdrawing an approval authority, pausing a process. Correction fixes the instance — obtaining the missing approval, completing the missing due diligence. Dealing with consequences addresses what has already happened — reviewing whether the unapproved hospitality created a bribery risk, notifying affected parties, considering self-reporting.

Containment and correction must be recorded separately from corrective action. Recording them in the same field is how organisations come to believe that a problem has been solved when only its symptoms have been treated.

3.4 Stage 5: root cause analysis

Root cause analysis answers the question the standards ask in Clause 10.2: what caused the nonconformity? The answer must be a cause that the organisation can change — a process design, a missing control, an unclear policy, a resourcing decision, an incentive, a system configuration. It should be specific enough that a corrective action can be designed to remove it.

Methods

Neither standard prescribes a method, and ISO 37301 Annex A.4.6 points to IEC 31010 for risk assessment techniques, several of which are used for cause analysis. The most practical methods for anti-bribery and compliance nonconformities are:

Human error is not a root cause

The most common failure in root cause analysis is to stop at the individual: “the manager forgot”, “the analyst made a mistake”, “staff were not aware”. James Reason’s work on human error, notably Human Error (1990), established that errors are better understood as consequences of the conditions people work in than as causes in themselves. The analysis should keep asking why: why was it possible to forget? Why did the system allow the step to be skipped? Why did no control detect it?

Note how far the analysis travels from “the manager did not follow the procedure”. Retraining the manager — the obvious response — would have done nothing about the cause.

3.5 Stage 6: extent analysis

Extent analysis is the stage most organisations omit entirely, yet it is written directly into Clause 10.2 of both standards: the organisation must determine whether similar nonconformities exist or could potentially occur, and ISO 37301 frames the purpose as ensuring the nonconformity does not recur or occur elsewhere.

Extent analysis asks two questions. First, does the same problem already exist elsewhere — in other transactions, business units, countries, processes or periods? Second, could it occur elsewhere — wherever the same root cause is present, even if no failure has yet been found?

The results of the extent analysis should be documented, including a clear statement of the population tested, the method and what was found. Where the extent analysis finds further instances, each should be corrected, and the scale of the problem may change its classification.

3.6 Stage 7: corrective action plan

The corrective action plan links each action to the root cause it addresses and to the full extent of the problem. Each action should state what will be done, by whom, with what resources, by when, and how its effectiveness will be judged. Clause 10.2 requires corrective actions to be appropriate to the effects of the nonconformity — proportionate, neither cosmetic nor excessive.

Where the corrective action changes the management system itself — a new control, a revised procedure, a reallocation of responsibility — it should be planned in accordance with Clause 6.3 of ISO 37301 (planning of changes), so that its effect on the rest of the system is considered. Speeki’s whitepaper on Clause 6.3 sets out how to do this.

3.7 Stage 8: implement

Implementation should produce evidence: the revised procedure with its version and approval, the system configuration change, the training records, the updated contract clauses. “Done” is not evidence. Each action in the plan should be marked complete only when its evidence is attached.

3.8 Stage 9: verify and retest

Clause 10.2 requires the organisation to review the effectiveness of any corrective action taken. This is not the same as confirming that the action was completed. It asks whether the cause has been removed and whether the nonconformity has stopped.

Effective verification has four features:

• It is performed by someone other than the person who implemented the action, so that it is an objective test rather than a self-assessment.

• It allows time. A new control cannot be shown to work on the day it goes live. The verification date should reflect how often the control operates — a monthly control needs several months of operation to test.

• It retests. The verifier performs the same test that originally detected the nonconformity, or a stronger one, on transactions that occurred after the corrective action, and records the population, the method and the result.

• It checks for side effects. Did the corrective action create a new problem — a bottleneck, a workaround, a gap elsewhere?

If the retest fails, the nonconformity stays open, the root cause analysis is revisited and a new corrective action is planned. A failed retest is useful information, not an embarrassment.

3.9 Stage 10: close and learn

A nonconformity should be closed only when the closure criteria are met and evidenced: correction completed, root cause documented, extent analysed and addressed, corrective actions implemented, effectiveness verified by retest. Closure should be approved by someone with defined authority — typically the head of the compliance or anti-bribery function — and dated.

Closure is also the point of learning. The compliance risk assessment should be updated where the nonconformity revealed that a control relied on was not effective. Trends in nonconformities, noncompliances and corrective actions are a required input to management review under Clause 9.3.2 of ISO 37301, and ISO 37301 Clause 9.1.2 requires feedback on compliance performance to be analysed to identify root causes and reflected in the periodic risk assessment.

4. Documentation Requirements

Both standards require documented information as evidence of the nature of each nonconformity, any subsequent actions taken, and the results of any corrective action. In practice, that means a record for every nonconformity that allows a reader — internal or external — to follow it from detection to closure without asking anyone a question.

4.1 The register

The register is the single index of all nonconformities, from every source. It should be one register — not one per source — so that trends across sources are visible. Each entry should hold, at a minimum:

4.2 Supporting records

Behind the register sit the working papers: the root cause analysis, the extent analysis with its population and test results, the corrective action plan, the implementation evidence and the verification test. These do not need elaborate templates. They need to exist, to be linked to the register entry, and to be retained under document control.

4.3 Version control

A nonconformity record evolves over weeks or months. Each update — a new action, a revised root cause, a failed retest — should increment the version and be dated, so that the current state is obvious at a glance and the history is preserved. Overwriting a record without a trail makes it impossible to show the auditor how the matter developed.

5. Two Worked Examples

5.1 An anti-bribery example: a first-line finding

A regional finance manager, reviewing monthly expenses, finds that a sponsorship payment was made to an industry association whose chair is a senior official at a regulator. The Sponsorships and Donations Procedure requires anti-bribery due diligence and compliance approval for any sponsorship involving a body with links to public officials. There is no due diligence and no approval.

5.2 A compliance example: a certification body finding

At a surveillance audit, Speeki raises a minor nonconformity against Clause 9.2 of ISO 37301. The organisation performed an internal audit of the compliance management system, but the purported internal audit did not satisfy the requirements of the clause: it was carried out by a member of the compliance function who also operates several of the controls audited, and the audit results were not reported to relevant management.

6. How Certification Body Findings Are Handled

Certification bodies operate under ISO/IEC 17021-1, the international standard for bodies certifying management systems. Several of its requirements shape how organisations must respond to Speeki’s findings.

• Definitions. A major nonconformity is one that affects the capability of the management system to achieve its intended results; a minor nonconformity does not. A number of minor nonconformities associated with the same requirement or issue can demonstrate a systemic failure and constitute a major nonconformity.

• Cause analysis. The certification body must require the client to analyse the cause and describe the specific correction and corrective actions taken, or planned, within a defined time (ISO/IEC 17021-1, clause 9.4.9).

• Before a certification decision. For major nonconformities, the certification body must have reviewed, accepted and verified the correction and corrective actions. For minor nonconformities, it must have reviewed and accepted the client’s plan for correction and corrective action (clause 9.5.2).

• Follow-up. Implementation of corrective actions for minor nonconformities is verified at a subsequent audit.

At Speeki, the lead auditor refers the certification file to Speeki’s Certification Committee with a recommendation, and the Committee makes the certification decision. Responses that offer correction without root cause analysis, or corrective action without a link to the cause, are not accepted.

Speeki’s findings should enter the organisation’s own register and go through exactly the same ten stages as any other nonconformity. Treating certification body findings as a separate, special category — managed by a different process — is itself a weakness.

7. Common Failures

8. What Speeki’s Auditors Look For

Speeki tests nonconformity management by following records, not by reading the procedure.

8.1 The register

• Does one register exist, covering all sources — first line, second line, internal audit, investigations, risk assessment, management review, external parties and Speeki?

• Is the proportion of entries from each source plausible? A register with no first- or second-line entries is a signal.

• Are entries versioned and dated, with owners and status?

8.2 Tracing nonconformities

The auditor selects nonconformities — including at least one not raised by Speeki — and traces each through the ten stages. Where Speeki has access to the register and supporting records in full, Nicole, Speeki’s AI audit team member, works with the audit team to review every entry rather than a sample, for example identifying records closed without verification evidence or root causes that stop at the individual.

• Is the statement factual, with requirement, evidence and gap?

• Are containment and correction recorded separately from corrective action?

• Does the root cause reach something the organisation can change?

• Is there a documented extent analysis, with the population and results?

• Is each corrective action linked to the root cause?

• Was effectiveness verified by someone other than the implementer, after an appropriate period, by retesting?

• Was closure approved on evidence?

8.3 Recurrence and learning

The auditor checks whether nonconformities closed in previous cycles have recurred — the clearest evidence that corrective action did not work — and whether trends in nonconformities, noncompliances and corrective actions were presented to management review, with decisions recorded.

8.4 Interview questions

• “Show me the last nonconformity your own team found — not one Speeki raised.”

• “How did you decide what caused it?”

• “How did you establish whether the same problem existed anywhere else?”

• “How do you know the fix worked?”

• “Who can close a nonconformity, and on what evidence?”

Grading is illustrative and depends on the evidence and its effect on the system.

Conclusion

Compliance and legal professionals are rarely short of problem-solving skill. What nonconformity management asks of them is a different discipline: to record what they find, to look past the instance to the cause, to look past the cause to everywhere it might be operating, to prove that the fix works, and to write all of it down. Clause 10.2 of ISO 37001 and ISO 37301 is short, but it describes precisely that discipline.

An organisation that builds it gains far more than a clean certification audit. Its register becomes the most honest picture of how its anti-bribery and compliance management systems actually perform. Its own monitoring, internal audit and investigations — not the certification body — become the main source of findings. And the same problems stop coming back. Fixed is not closed. Closed means found, understood, extended, corrected, retested and documented.

About Speeki

Speeki is an accredited certification body operating across more than 100 countries, providing ISO management system certification, ESG and sustainability assurance, and executive education. Speeki provides no consulting of any kind. Our independence is structural, not a promise.

Speeki delivers its audits through AI working alongside a body of experts. Nicole, Speeki’s AI team member, works with our auditors to test full populations of evidence rather than samples, so that certification reflects how a management system actually performs, not how it looks on the day of the audit.

To learn more, see ISO 37301 certification with Speeki.

References

International Organization for Standardization (2025). ISO 37001:2025 Anti-bribery management systems — Requirements with guidance for use. Geneva: ISO.

International Organization for Standardization (2021). ISO 37301:2021 Compliance management systems — Requirements with guidance for use. Geneva: ISO.

International Organization for Standardization (2015). ISO 9000:2015 Quality management systems — Fundamentals and vocabulary. Geneva: ISO.

International Organization for Standardization and International Electrotechnical Commission (2015). ISO/IEC 17021-1:2015 Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements. Geneva: ISO.

International Organization for Standardization (2018). ISO 19011:2018 Guidelines for auditing management systems. Geneva: ISO.

International Electrotechnical Commission (2019). IEC 31010:2019 Risk management — Risk assessment techniques. Geneva: IEC.

International Electrotechnical Commission (2006). IEC 61025:2006 Fault tree analysis (FTA). Geneva: IEC.

Institute of Internal Auditors (2020). The IIA’s Three Lines Model: An Update of the Three Lines of Defense. Lake Mary, FL: IIA.

Ishikawa, K. (1986). Guide to Quality Control (2nd revised ed.). Tokyo: Asian Productivity Organization.

Ohno, T. (1988). Toyota Production System: Beyond Large-Scale Production. Cambridge, MA: Productivity Press.

Reason, J. (1990). Human Error. Cambridge: Cambridge University Press.

Reason, J. (1997). Managing the Risks of Organizational Accidents. Aldershot: Ashgate.

Related Reading

• Building a Non-Conformity Management System

• Change Without a Method Is Just Hope: Planning Changes to a Compliance Management System (ISO 37301 Clause 6.3)

• Documented Isn’t Operating: Controls and Indicators That Prove the System Works

• The Channel and the Verdict: Raising Concerns and Investigations Under ISO 37301

This whitepaper provides general information on ISO 37301:2021 and does not reproduce the text of the standard. Organisations should refer to the published standard for its exact requirements.