Corrective actions are steps taken to remediate or reduce the impact of control weakness or non-conformity. Corrective action plan however is a step by step plan of action that is developed to achieve specific outcomes of resolution of noted non-conformities or control weakness. To ensure effective corrective actions, the auditee should perform a root cause analysis to identify the cause and effect of the control weakness or non-conformity to the business. This is to ensure that an effective remediation or treatment is implemented to address the issues completely or reduce the impact of the non-conformity.
The auditee is responsible for implementing corrective actions to address non-conformity. A compliance certificate or report is usually issued by the auditee confirming that all or some of the noted control weaknesses or non-conformities have been corrected partially or completely. Detail of the remediation including new audit evidences confirming the correction should be provided to the audit team for reassessment. Where the corrective actions implemented fully address the non-conformities, the audit team are expected to close the issues in their follow up or issue tracker report.