A CAPA register your auditor — and your biggest customer — can trust.
Open corrective actions are the single most common cause of surveillance-audit nonconformities and enterprise supplier flags. ISO-STANDARD.app is the CAPA workspace SMEs and consultants use to keep the ISO 10.1 / 10.2 loop closed: source, root cause, correction, effectiveness review, automatic overdue chasing. Built by a founder with 25+ years in IT governance.
Why CAPA lists fail
Most CAPA registers are three columns wide: what, who, when. They tell the auditor nothing about root cause and produce no evidence that the correction actually worked. The next audit finds the same nonconformity, and the finding becomes "systemic".
ISO-STANDARD.app models CAPA the way ISO 10.1 and 10.2 describe it: an event triggers a correction (fix the symptom now), a root-cause analysis (why did it happen?), preventive action (stop it recurring), and an effectiveness review after a set period. Each of those is a required field, not an optional column.
Features
Structured CAPA record
Source (audit / risk / incident / management review / other), root cause, correction, corrective action, owner, due date, status and effectiveness review.
Linked to the finding
Every CAPA raised from an internal audit stays linked to the finding and the clause — traceability the auditor can follow both ways.
Overdue reminders
Overdue and upcoming CAPAs surface on the dashboard and in governance reports so action owners can't quietly let them drift.
Effectiveness review workflow
A scheduled prompt to record whether the action actually prevented recurrence — the piece most CAPA logs skip.
Ageing analytics
See CAPAs by status and age. Trend improvement over time as evidence of ISMS/QMS maturity for management review.
Exportable register
One-click export of the full CAPA register for the audit pack, with source, root cause and closure evidence per action.
Who it's for
Compliance leads under ISO 27001 or 9001
Pain: A CAPA log that never gets closed and repeats the same finding every year.
With ISO-STANDARD.app: Root-cause discipline enforced by the tool, plus reminders that push overdue actions to closure.
Operations teams handling incidents
Pain: Incidents get triaged but the follow-up preventive actions never land.
With ISO-STANDARD.app: Every incident can spawn a CAPA linked to the event, with an owner and effectiveness review baked in.
Stop losing corrective actions in a spreadsheet
Try the CAPA register free. Import your open actions, assign owners, and let the platform chase the follow-ups.
Assisted drafting for policies, risks, controls and buyer questionnaires. Every AI suggestion is reviewed and approved by you before it lands in the record.
Opt-in, workspace-scoped
AI features run only when you invoke them, only against the workspace you're in. We never mine your data to answer someone else's prompt.
Your data stays yours
Prompts routed via the AI Gateway to model providers whose API terms exclude your content from model training. Nothing is sold or shared for advertising.
Isolated by design
Row-level security enforces workspace boundaries at the database. MFA, SSO, audit logs and least-privilege roles govern who sees what.
We never sell personal information, never share it for advertising, and never use your workspace content to train third-party models. Full sub-processor list and Acceptable Use Policy on the Trust page.
MM
Michael McCarroll
Founder · 25+ years
IT governance · Information security · AI
Why this platform exists
Enterprise-grade governance — built for the SMEs and consultants enterprise GRC forgets.
I've spent 25 years in corporate governance — aligning technology, controls and compliance with what the business is actually trying to do. Time and again, the same pattern: the organisations that win new clients aren't the ones with the biggest GRC budget. They're the ones who can demonstrate trust on demand. This platform is the tool I wanted for the SMEs and consultants I've worked with — institutional-grade governance without an institutional price tag, built on the way audits and buyer reviews actually happen.