Assessment to finding closure

Step by step

1. Scope assessment Assessment Owner

   Assessment Owner chooses the organization, business unit, period, owner and subject. The scope statement explains what will be examined.

   • Defines period and owner
   • Updates Assessments, Organizations, Business units, Team members

2. Plan control tests Assessment Owner

   The owner identifies controls and planned lines for the assessment revision. Each line belongs to a real control.

   • Connects planned lines to controls
   • Updates Assessments, Assessment tests, Controls

3. Test controls Assessment Owner

   The team records sample size, exceptions, result, date and evidence reference. The assessment can enter Review after the intended tests have outcomes.

   • Records result and evidence
   • Updates Assessment tests, Record attachments

4. Register finding Assessment Owner

   A failed or inconclusive test leads to a finding linked to the same assessment and control. Its severity and description identify the observed issue.

   • Opens a linked exception
   • Updates Findings, Assessment tests

5. Plan corrective action Remediation Owner

   Remediation Owner accepts a dated action and records the evidence of work performed.

   • Assigns response and due date
   • Updates Corrective actions, Findings

6. Independent retest Independent Reviewer

   Independent Reviewer examines the correction and records a fresh result. A Pass supports closure; Fail and Inconclusive keep the finding open.

   • Records independent result and closure basis
   • Updates Retests, Findings, Corrective actions
   ApprovalA person approves before the work moves on.

7. Review assessment Independent Reviewer

   Independent Reviewer records a revision-bound decision and reason. That judgment does not itself change the parent assessment outcome.

   • Records a reason for the examined revision
   • Updates Review decisions, Assessments
   ApprovalA person approves before the work moves on.

Assessment Owner

, Control Owner, Remediation Owner, Independent Reviewer, Risk Manager, Admin.