Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Register

CAPA Register

Updated on 2 min Reviewed by: Cenedril-Redaktion
Clause 10.1Clause 10.2 ISO 27001

The CAPA register (Corrective and Preventive Actions) is where you document nonconformities, root cause analyses and corrective actions. Every finding needs a traceable chain: what was observed, why it happened, what was done immediately, and what prevents recurrence.

ISO 27001 Clause 10.1 (Nonconformity and Corrective Action) and Clause 10.2 (Continual Improvement) provide the normative basis. Auditors expect you to show, for every nonconformity, which corrective action was taken and whether it was effective.

What does it contain?

Each row documents one CAPA case. The columns:

  • ID / Source / Date Raised — unique identifier, origin of the finding (audit, incident, review) and date recorded
  • Finding / Nonconformity — description of what was observed
  • Root Cause — result of the root cause analysis
  • Correction (Immediate) — containment measure to limit damage
  • Corrective Action — measure to eliminate the root cause
  • Owner / Due Date / Status — responsible person, deadline and current state
  • Effectiveness Check / Closure Date — result of the effectiveness verification and closure date

How to use it

Capture: As soon as a finding arises — from an internal audit, external audit, incident or management review — create a new row. Record the immediate correction and the responsible person straight away.

Root cause analysis and corrective action: Within a defined timeframe (typically two weeks), analyse the root cause and define a corrective action with a concrete deadline.

Effectiveness check: After a probation period (e.g. one quarter), sample-check whether the finding has recurred. Document the result in the Effectiveness Check column. Only then close the case.

Register Template

CAPA Register

.csv · EN.csv · DE
IDSourceDate RaisedFinding / NonconformityRoot CauseCorrection (Immediate)Corrective ActionOwnerDue DateStatusEffectiveness CheckClosure Date
CAPA-2026-001Internal audit 2026-Q12026-02-10Three joiner accounts were created without manager approval ticketOnboarding checklist did not enforce approval gateRevoked accounts and recreated with approvalAdd mandatory approval gate in HR onboarding workflow + monthly reconciliationHR Lead2026-05-15In progressAudit sample 2026-Q3
CAPA-2026-002External audit 20252025-12-05SoA did not cite justification for excluding A 8.34Reviewer used prior-year SoA without re-checkAdded justificationRequire peer review of SoA before approvalISO2026-03-01Closed2026-03-15 re-check passed2026-03-20
CAPA-2026-003Incident INC-2026-0042026-02-22Phishing email bypassed filter; one user clicked linkFilter policy did not cover newly registered domainsBlocked domain + reset user credentialsEnable newly-registered-domain rule in mail filter and run targeted awareness trainingIT Operations Lead2026-04-30In progressPhishing simulation 2026-Q3
CAPA-2026-004Management review 2026-Q12026-03-30Vulnerability remediation SLA breached for 4 high findingsPatch window too short; no escalation pathApplied patchesIntroduce monthly patch window + escalation to CTO after 25 daysIT Operations Lead2026-06-30OpenKPI review 2026-Q3
CAPA-2026-005Customer complaint2026-03-12Customer reported unencrypted email attachment with contractStaff used personal workaround after mail gateway issueRetrieved email and re-sent via secure portalRefresh training on Information Transfer Policy + block external attachments over 10MBDPO2026-05-31In progress

Sources

ISO 27001 Controls Covered

Clause 10.1 Continual improvement Clause 10.2 Nonconformity and corrective action

Frequently asked questions

What is the difference between a correction and a corrective action?

A correction is the immediate containment (e.g. revoke compromised accounts). A corrective action eliminates the root cause so the problem does not recur (e.g. add an approval gate to the onboarding workflow). Both belong in the register — the CSV template has separate columns for each.

How do I verify the effectiveness of a corrective action?

ISO 27001 Clause 10.1 requires you to evaluate whether the action actually eliminated the root cause. In practice: after a defined period (e.g. one quarter), sample-check whether the finding recurs. Document the result in the Effectiveness Check column.

Does every nonconformity need a CAPA entry?

Yes. Clause 10.2 requires a documented response to every nonconformity — immediate correction, root cause analysis and corrective action. Even minor findings from internal audits belong in the register so you can demonstrate the full chain during the certification audit.