Findings and remediation

A finding records severity, opening date, description, assessment and control. That connection matters: a reviewer should be able to identify which control was examined and which engagement produced the exception. A failed or inconclusive test can support a finding. A passing or pending test should not be recast as one merely to create a work item.

A corrective action belongs to the finding and names an owner. It carries a due date, a target completion date, evidence and a state from Planned through Verified. The action owner explains what will change and records progress. A separate retest decides whether the change resolved the finding. This division prevents an owner marking their own work Verified from standing in for independent examination.

• Finding. Record the actual exception with severity and a specific description.
• Action. Assign a named owner, due date, planned completion date and evidence.
• Verification. Keep the finding open until independent retest supports closure.

Agree how Low, Medium, High and Critical are used and who can correct a misclassified finding. Set a due-date policy that the Remediation Owner and Independent Reviewer can understand. Record the intended completion date when planning the action, then distinguish it from the date work actually finishes when reporting progress.

Decide what evidence is sufficient for a submitted action. A narrative in the action can explain the change, but a reviewer may also need an assessment attachment or a source-system reference. Define who may see internal attachments. The status action planned on the finding and Submitted on its action answer different questions, so do not collapse them into one queue.

Use a failed payment approval test with two exceptions. Open a finding against the same assessment and control, choose High severity and describe the observed gap. Assign an action to a team member with a due date and evidence explaining the revised procedure. The owner moves the action into progress and submits the result for review.

Ask the owner to try closing the finding. The closure should wait for a separate reviewer and a passing retest. If the retest fails or remains inconclusive, keep the issue open and plan another response. The reviewer should be able to see the original test, the action evidence and the latest retest without relying on a verbal handoff.

• Open findings — Review severity and status for issues still needing action or retest.
• Action owner queue — Show assigned action due dates and current state.
• Corrective actions submitted — Find work awaiting independent examination.

Follow the remediation process and review independent retest.