Under ISO 14001, what is the first step an organization must take when a nonconformity is identified during an internal EMS audit?