Findings and remediation

A finding records the issue discovered in control testing. It links to the assessment and control, carries a severity and opened date, and moves through open, action-planned, retest and closed states. That record explains what went wrong. A corrective action is a separate assignment against the finding. It has an owner, due date, evidence, completion date and its own progress status. Keeping those records distinct lets the team see whether an issue exists, whether work is assigned and whether the work was independently checked.

A retest also belongs to the finding. It records the reviewer, test date, result and evidence. The reviewer can mark the result as pass, fail or inconclusive. The action owner may document completion, but an independent retest tells the compliance lead whether the correction addressed the original issue.

• Finding. State the issue, severity and affected control under the assessment.
• Action. Give the correction a named owner, due date and written evidence.
• Retest. Have a separate reviewer examine the result and record the outcome.

Choose how severity levels affect review order and who is allowed to close a finding. Agree what counts as sufficient corrective evidence and when an action can be submitted for verification. The action owner should be able to explain the remedy without editing the original test result. The reviewer needs a clear way to record an unsuccessful retest and send the finding back for more work.

The pilot should include a failed test, a finding, a planned action and a retest. If the first retest is inconclusive, the team should keep the case visible until it receives enough evidence. The compliance lead should review due dates and unresolved findings before closing the assessment.

A control test finds that a monitoring log was incomplete for a sampled period. The compliance lead opens a high-severity finding against the affected control. The action owner receives a due date and records how the log process was corrected, with supporting evidence. After completing the work, the owner submits the action. A separate reviewer performs a retest of the same control and records a passing result with the test evidence.

The finding can then move from retest to closed, and the action can be verified. If the reviewer instead records fail, the lead keeps the issue open and assigns further correction. The original failed test, action and retest remain linked so someone examining the assessment later can follow what changed and why closure was justified.

• Open findings — Prioritize unresolved issues by severity and related control.
• My corrective actions — Show an action owner their assigned work and due dates.
• Retests requiring follow-up — Keep failed and inconclusive verification visible.

Follow finding remediation and retest and the assessment testing process.