Create NCR Register template for ISO/IEC 42001:2023

Added a comprehensive Nonconformity and Corrective Action Register template for ISO/IEC 42001:2023 compliance, including sections for severity classification, sources, and corrective action processes.

Author: Ankit-Uniyal

09-CLAUSE10-IMPROVEMENT/NCR-REGISTER.md

@@ -0,0 +1,79 @@
+# Nonconformity and Corrective Action Register (NCR Register)
+## ISO/IEC 42001:2023 | Clause 10.1 — Template
+
+**Document ID:** AIMS-NCR-001
+**Version:** 1.0
+**Owner:** AI Governance Lead
+**Date:** ___________________________
+**Review Cycle:** Monthly; updated as NCRs arise
+
+---
+
+## NCR Severity Classification
+
+| Severity | Description | Response |
+|---------|-------------|---------|
+| Critical | Complete failure; significant harm; major regulatory breach | Immediate containment; root cause within 48h; CA within 30 days |
+| Major | Significant AIMS failure; effectiveness compromised | Root cause within 5 days; CA within 30 days |
+| Minor | Partial non-compliance; isolated failure | CA within 60 days |
+| Observation | Improvement opportunity; not yet a nonconformity | Consider improvement action |
+
+---
+
+## NCR Sources
+
+| Source | Examples |
+|--------|---------|
+| Internal Audit | Audit finding |
+| AI Incident | System failure; harmful output |
+| Performance Monitoring | Metric below target |
+| Management Review | Identified at review |
+| Stakeholder Complaint | Customer, employee, regulator |
+| Supplier Nonconformity | Third-party AI vendor failure |
+| Self-identified | Identified by process owner |
+| External Audit | Certification body finding |
+
+---
+
+## Nonconformity Register
+
+| NCR ID | Date | Source | Description | Severity | Clause | AI System | Immediate Action | Root Cause | Corrective Action | CA Owner | Due Date | Status | Effectiveness Check | Closed |
+|--------|------|--------|-------------|---------|--------|---------|-----------------|-----------|------------------|---------|---------|--------|---------------------|--------|
+| NCR-001 | | | | Critical/Major/Minor | | | | | | | | Open | | |
+| NCR-002 | | | | | | | | | | | | | | |
+| NCR-003 | | | | | | | | | | | | | | |
+
+---
+
+## Corrective Action Process
+
+1. **Detect and Record** — Raise NCR with description, date, and source
+2. **Contain** — Take immediate action to stop harm spreading
+3. **Root Cause Analysis** — Use 5 Whys, Fishbone, or fault tree analysis
+4. **Plan CA** — Define specific actions to address root cause
+5. **Implement** — Execute corrective actions; update documentation
+6. **Verify Effectiveness** — Check the fix worked; close only when confirmed
+7. **Update AIMS** — Update risk register, procedures, or controls as needed
+
+---
+
+## NCR Summary Dashboard
+
+| Period | Raised | Critical | Major | Minor | Closed | Overdue |
+|--------|--------|---------|-------|-------|--------|---------|
+| Q1 [Year] | | | | | | |
+| Q2 [Year] | | | | | | |
+| Q3 [Year] | | | | | | |
+| Q4 [Year] | | | | | | |
+
+---
+
+## Review History
+
+| Version | Date | Changes | Approved By |
+|---------|------|---------|-------------|
+| 1.0 | | Initial issue | |
+
+---
+
+*ISO/IEC 42001:2023 AI Governance Toolkit | Clause 10.1 | See root README.md for full index*