Active Improvements

In today’s complex regulatory and security landscape, organizations must take a proactive approach to managing risks, ensuring quality, and protecting sensitive information. Key principles like continuous improvement, root cause analysis, and treatment plans are integral to frameworks such as ISO 27001, ISO 27701, ISO 9001, the NIST Cybersecurity Framework, and GDPR. 

A structured approach to improvement, driven by thorough root cause analysis, ensures issues are addressed at their core, preventing recurrence and reducing long-term risks. Well-defined treatment plans then help tackle identified weaknesses, providing tailored solutions that align with business goals and regulatory requirements. 

Thus, the ‘Improvements Section’ becomes invaluable in helping your organization manage and oversee this process. It provides a structured framework for recording, maintaining, and overseeing improvements through ownership and clear deadlines for completion.  

Continuous improvement is a cornerstone of Lean Compliance, and in our Compliance Framework, we’ve embedded this principle at every level of our procedures and operations. Each improvement is carefully evaluated for its effectiveness and reviewed during the annual Management Review. This final assessment allows us to validate the overall effectiveness of you framework, ensuring it meets the highest standards. 

In our approach, we actively look for opportunities for improvements across all compliance processes. Continuous improvement is often referred to using various terms, and understanding these terms helps in addressing and enhancing our compliance practices, as explained below:  

• Non-Conformity: A non-conformity refers to a failure to meet a specific requirement, standard, or expectation outlined in a compliance framework, policy, or procedure. It indicates that a process, system, or practice does not align with the established criteria or regulations. Non-conformities typically require corrective actions to address and resolve the issue, preventing recurrence. 

• Opportunity for Improvement (OFI): An opportunity for improvement is a situation where there is potential to enhance existing processes, practices, or systems. It is not necessarily a failure, but rather an area where small changes could lead to greater efficiency, effectiveness, or compliance. Identifying OFIs helps organizations continuously optimize their operations and mitigate risks. 

• Areas of Concern: Areas of concern are specific aspects of a system, process, or operation that could pose a risk or lead to problems if not addressed. These areas may not be non-conformities but are identified as requiring attention due to their potential impact on compliance, performance, or security. They are often highlighted during external audits or assessments and may lead to corrective actions or improvements. 

• Findings: Findings are results or observations that arise during assessments such as Privacy Assessments, ISRA, DRP, BCP Assessment or reviews, which may highlight weaknesses, risks, or non-compliance issues. These findings must be documented and typically lead to the formulation of corrective or preventive actions to address identified issues. 

• Improvements: Improvements refer to actions taken to address non-conformities, opportunities for improvement, areas of concern, or findings. These changes aim to enhance processes, mitigate risks, increase efficiency, or align with compliance requirements. Continuous improvement is central to maintaining high standards and ensuring that systems evolve to meet changing regulatory or operational demands. 

By aligning all opportunities for improvement to a single, consistent improvement process, you gain better control and enhanced oversight of what you are working on. This streamlined approach ensures that all efforts are focused, tracked, and managed , allowing for more efficient decision-making and clearer visibility into progress across your organization. 

The Improvements section is designed to offer two different views for easy management of identified improvements: 

• Schedule View: This provides an overview of improvements with a focus on deadlines, giving you a clear timeline for addressing each improvement. 

• List View: In this view, you can select, sort, or search for specific improvements, making it easier to track and manage multiple actions. You can decide the time frame for improvements by selecting the Start Month and End Month. 

Please refer to the Risk Treatment Plan Process referenced in the Security Policy Farmwork, which can be accessed in the Compleye Online Templates Section. The Risk Treatment Plan outlines the procedures for documenting and addressing identified non-conformities, opportunities for improvement, or any other issues. It covers both the planning and implementation phases, ensuring that all areas are systematically addressed. 

Tips for Adding Improvements: 

• Choose a clear and recognizable title for your improvement that both you and your ISMS team can easily identify. Once defined, avoid changing the title to prevent confusion. 

• Assign an owner to the improvement. Keep in mind that owners can change, but it’s essential to have someone accountable. 

• Ensure you use the same definition for “finding” as the original source (e.g., assessment). This will help avoid any misunderstandings down the line. 

• Specify the origin of the improvement, this identifies where the improvement is coming from. 

•  Set a due date for the first milestone or task related to the improvement. While some improvements may take several months, prioritize a due date for the next critical attention point. 

• Identify other areas that may be impacted by the same finding. Ask yourself, “Could this finding also affect other products, projects, or team members?” Take these areas into account when drafting your treatment plan. Additionally, consider whether the finding requires immediate action or if it can be addressed within the regular timeline. 

• Use methods like the 5-Why technique to dig deeper and identify the root cause of the issue. Understanding the true cause can help you address it at a more effective level. Always document your findings for the root cause. 

• Define a high-level solution or approach to resolve the problem. You can attach supporting documents or screenshots as evidence for your plan. 

• Consider how much the improvement will impact your technical team versus non-technical teams.  

•  Keep track of progress and add notes, even if there is no progress. If the improvement is stalled, record the reasons for the delay. 

• Once the improvement is implemented, change its status from “In Progress” to “Ready for Evaluation.” If you believe the improvement is no longer relevant or effective, stop the work and initiate the evaluation process. 

•  If you regularly organize compliance meetings, include improvements as part of the standard agenda to keep track of ongoing actions. 

• After saving the improvement with an assigned owner and deadline, the evaluation screen will appear. Use this to monitor the outcome and assess the effectiveness of the improvement. 

• Review Process: Ensure that the person reviewing the improvement is not the same as the owner. We recommend evaluating improvements during security meetings to ensure impartiality. 

• Effectiveness: Address all topics in this section, as it will save you time during the management review phase. Keep it practical and focused. For example, if the improvement is related to assessments aimed at reducing risks, verify whether it truly mitigates risks or perhaps improves efficiency, integrity, or accuracy. Not all improvements will directly impact the original finding. Changes in circumstances or other improvements may have already resolved the issue. Be sure to note this. 

• Management Review: Assign the improvements to a relevant Management Review topic. Include a concise summary of the improvement, indicating what you want to communicate to the external auditor or C-Level management 

Management Review Report Automation: 

The last two points must be completed to enable the automatic generation of your Management Review Report within Compleye Online. The content you provide during the evaluation of the improvement will be pre-filled when you generate the report from the ‘Closed Improvements Subsection’. For more details on report automation, refer to the Management Review topic, where you can find full instructions. 

Once an improvement is closed, it will automatically be moved to the ‘Closed Improvements Section’.