Findings and remediation

A failed or inconclusive control test can lead to a finding. The finding names the assessment and control, describes the specific issue, records severity and marks when it opened. This connection matters when an action owner must understand what failed and a reviewer later decides whether the fix worked. A passing or pending test should not be the source of a new finding.

Take a failed sample of campus access approvals. The Assessment Owner describes the exception rather than restating the control title. The Finding Owner receives an action with a due date, evidence and a target completion date. The action can move through planning, work in progress and submission. The finding remains distinct from that action: submitting evidence alone does not close the finding.

• Issue. Severity, description and opened date identify the failure that needs a response.
• Action. A named owner, due date and evidence show what the team intends to change.
• Verification. The independent retest records whether the correction addressed the finding.

Agree severity meanings and who may assign a Finding Owner. Decide what evidence an action owner must submit before a retest. The action’s completion date is required even while work is planned, so record the target date consistently and review it when the actual work is completed. A due date and a target completion date answer different questions; both should be understood by the operating team.

Set a clear escalation for overdue actions. The team can review due dates and status together without treating an overdue action as already verified. Keep the finding open or at the retest stage until an independent reviewer examines the correction. A failed or inconclusive retest should lead back to more action, with the original finding still visible.

Start with a failed test, open a specific finding and assign an action. Ask the owner to explain the corrective work and show its evidence. Then have a different person perform the retest. Check that a passing result verifies the action and closes the finding, while a failed result leaves it unresolved. This rehearsal reveals whether the owner and reviewer duties are truly separate. Check the original test result again so the finding describes the sampled failure, not a general concern about the campus.

• Remediation in Flight — Planned, active and submitted actions with owners and due dates.
• Unresolved Findings — Findings still open, in action planning or awaiting retest.

Use testing and findings to register the issue and remediation and retest to verify the response.