Corrective Actions Procedure

The Lead Internal Auditor or the Information Security Manager would be the most probable candidates to document this procedure.

Please note that while ISO 27001 does not prescribe who needs to develop documents, it requires that person doing work that affects information security performance (like documenting procedures) to have proper competencies (i.e., education, training, or experience).

This article will provide you a further explanation about corrective actions:

• Practical use of corrective actions for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2013/12/09/practical-use-of-corrective-actions-for-iso-27001-and-iso-22301/

These materials will also help you regarding documenting policies and procedures:

• Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
• ISO 27001 Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/