ISO 27001 continual improvement: turning findings into value

Demystifying the Findings: From Fear to Feedback

In my two decades of auditing, I have seen too many leadership teams panic when an auditor identifies a non-conformity. In the context of ISO 27001, a finding is simply data; it is an objective statement that a specific part of your Information Security Management System (ISMS) is not meeting the requirements of the standard or your own internal policies. Clause 10.1 is very clear: when a non-conformity occurs, you must react, take action to control it, and deal with the consequences.

The value of these findings lies in their ability to pinpoint exactly where your business processes are leaking efficiency or creating risk. If an auditor finds that three developers haven't signed their Acceptable Use Policy, that isn't just a compliance fail; it’s a sign that your onboarding process is fragmented. Fixing that fragment saves HR time and reduces legal exposure, which is a tangible business win.

• Major Non-conformity: A total breakdown of a required element (e.g., no internal audit performed).
• Minor Non-conformity: A single lapse or partial failure (e.g., one person missed a training module).
• Opportunity for Improvement (OFI): A suggestion for better practice that isn't currently a breach of the standard.
• Observation: A neutral finding that flags a specific fact for future consideration.

Root Cause Analysis: Why 'Human Error' Is Never the Answer

The biggest mistake firms make is 'patching' the symptom instead of fixing the system. If an employee's laptop isn't encrypted, the 'correction' is to encrypt it, but the 'corrective action' is to determine why the automated MDM policy didn't catch it in the first place. This is where the '5 Whys' technique becomes your best friend. You must keep digging until you find the systemic failure that allowed the human error to occur.

Clause 10.1(b) requires you to evaluate the need for action to eliminate the causes of non-conformity so that it does not recur or occur elsewhere. This often means updating a process, changing a configuration, or improving a training module. If you find yourself 'correcting' the same issue every six months, you haven't actually addressed the root cause. Auditors will spot this pattern and escalate minor issues to major ones if they see a lack of systemic resolution.

A robust Root Cause Analysis (RCA) should involve the people doing the work, not just the CISO. By bringing the engineering or operations team into the discussion, you get realistic solutions rather than mandates that people will just find workarounds for. This collaborative approach ensures that the improvement actually 'sticks' and provides real-world value to the team's daily workflow.

Building a Heartbeat of Improvement

Continual improvement (Clause 10.2) should not be an annual event triggered by an external audit. High-performing organisations treat it as a heartbeat. You need a structured rhythm for identifying, logging, and addressing improvements throughout the year. This prevents the 'pre-audit scramble' where teams spend three weeks faking records to satisfy an auditor—a practice that provides zero security value and destroys team morale.

I recommend a 'Continuous Audit' cycle where you inspect a small subset of controls every month. This keeps the ISMS top-of-mind for your staff and ensures that small drifts in compliance are caught before they become major liabilities. It also generates a steady stream of data for your Management Review, making that mandatory meeting far more productive and evidence-based.

• Quarterly ISMS internal audits focused on specific high-risk departments.
• Monthly 'Security Champion' syncs to gather feedback from the front line.
• Automated monitoring of Clause 9.1 metrics like patch latency or access review completion.
• Regular review of the 'Unresolved Findings' list during Senior Management meetings.

Commercial Velocity: How Improvement Wins Deals

In the tech world, 'technical debt' is a known killer of velocity. Think of unresolved audit findings as 'compliance debt.' If you ignore them, they compound. Eventually, you find yourself unable to pass a Tier 1 bank's security questionnaire because your underlying processes are a mess of manual workarounds and outdated policies. Clearing your findings register is, in effect, paying down that debt to increase your sales velocity.

Senior management often views security as a cost centre, but showcasing a track record of continual improvement changes the narrative. When you can show that you identified an inefficiency in access revocation, automated it, and saved 10 hours of admin per month while increasing security, you are demonstrating ROI. ISO 27001 is the framework that allows you to quantify and report these wins to the board.

Furthermore, when a prospect asks for your latest audit report, seeing a list of proactively managed findings is actually more impressive than a blank sheet. It proves your organisation has the maturity to identify its own weaknesses and the discipline to fix them. That level of transparency builds the kind of 'Trust Equity' that closes enterprise deals faster.

The Golden Thread: Evidencing the Loop

The 'Corrective Action' log is the most important document in your ISMS, yet it is often the most neglected. It needs to be a living document, not a static PDF buried in a folder. To satisfy Clause 10, your record-keeping must show a clear 'Golden Thread' from finding to root cause analysis, to action, and finally to effectiveness verification. If you skip that last step, the auditor will consider the action incomplete.

Effectiveness verification is where most firms stumble. It’s not enough to say 'we did the training.' You have to prove the training worked. Three months after the action, you should re-test the area. If the error rate has dropped, the action was effective. If it hasn't, you need to go back to the drawing board. This level of rigour is what separates a world-class security posture from a 'paper-only' compliance exercise.

• Log: Date, Source (Audit/Incident/Suggestion), Description.
• Analysis: Root Cause, Risk Impact (High/Med/Low).
• Action: Specific steps, Owner, Deadline.
• Verification: Effectiveness check date and signature.

Closing the Feedback Loop: Risk to Improvement

One overlooked source of improvement is your risk treatment plan. ISO 27001:2022 places a heavy emphasis on the alignment between risk and performance. If you have a high-risk area that hasn't seen any 'improvement' activities in a year, your risk assessment is likely disconnected from reality. Continual improvement is the mechanism by which you lower your residual risk over time.

Finally, treat your ISMS like a product. It has users (your employees), stakeholders (your board and customers), and a set of requirements. Just as you wouldn't leave a software product to rot without updates, your security framework needs a roadmap of 'features'—which in this case are the improvements and corrective actions you've identified. This mindset shift turns ISO 27001 from a 'burden' into a competitive advantage.

Frequently asked questions