Clause 10.2: Incident, nonconformity and corrective action
The organization sets up, runs and keeps processes, covering reporting, investigation and action, for identifying and managing incidents and nonconformities.
What clause 10.2 asks
The organization sets up, runs and keeps processes, covering reporting, investigation and action, for identifying and managing incidents and nonconformities. Whenever one of these arises, it: responds promptly, acting to bring it under control and correct it and dealing with what it has caused; decides, with workers taking part and other relevant interested parties involved, whether corrective action is needed to remove the root causes so that the problem neither happens again nor happens somewhere else, by looking into the incident or examining the nonconformity, finding its causes, and finding out whether similar incidents or nonconformities exist or might arise; reviews, where appropriate, the assessments already made of OH&S risks and of other risks; decides on and carries out corrective action following the hierarchy of controls and the management of change; assesses the OH&S risks tied to new or altered hazards before acting; reviews whether the action taken worked; and changes the system where needed. Documented information is retained on what the incidents and nonconformities were, what was done about them, and what the corrective action achieved and how effective it was, and this is communicated to the relevant workers, their representatives and other relevant interested parties.
Corrective action has to remove the cause, not just the symptom. Workers take part, the risk assessment is revisited, and the effectiveness of the action is reviewed.
Report and investigate a remote incident. A remote incident may happen at home, on the way to a client site or in a co-working space, and the worker may be alone. The report has to be easy to make, the investigation has to reach the workplace and the worker's account, and the corrective action has to change the arrangement. The public consultation's lone-working and reduced-supervision points make the reporting route a control, not an administrative step.
Basis: BSI, BSI Standards Development. For clause 10.2, the public record is a draft guideline and does not state a requirement in terms that this site can quote. The clause 10.2 overlay is our reading of the public scope and the named summaries, not the draft text.
Evidence for clause 10.2
An auditor will take an incident and follow it from the report to the root cause, the risk assessment update and the effectiveness review.
- Incident investigation Incident and nonconformity register
- Incident investigation Investigation reports with root cause analysis and worker participation
- Incident investigation Corrective actions showing hierarchy of controls applied
- Incident investigation Risk assessment reviews triggered by incidents
- Incident investigation Effectiveness reviews and communication records to workers
Where clause 10.2 commonly fails
- Investigations stop at immediate cause
- Workers not involved in investigations
- Risk assessments not updated after incidents
- Effectiveness of corrective actions not reviewed
What to do about clause 10.2 before the guidance lands
Add a remote incident route with a named contact and a backup. Investigate the immediate and underlying cause with the worker, update the assessment and the equipment, and check that the reporter was not disadvantaged. Record the close-out.
For clause 10.2, do the work that will be right under either instrument. The current requirement for clause 10.2 is ISO 45001:2018, and the certificate, if you hold one, is issued against it. The clause 10.2 remote working preparation is an extension of the existing duty to a group of workers the system already covers, not a new system and not a reason to rebuild around a draft.
Read across from clause 10.2
Open the full index. The public record behind clause 10.2 shows the scope and the themes.
Source for clause 10.2: ISO 45001:2018, clause 10.2, retrieved 20 October 2026, record at the standards library. The clause 10.2 remote overlay rests on the public 45008 record named above. The clause 10.2 requirement, evidence and gaps are written from our clause record. Every source.