Findings and remediation

A finding records what failed, its severity, opening date, status and specific description. It points to the assessment and control that were tested. The corrective action is a separate record with an owner, due date, evidence and progress status. This separation lets the team see the problem even when the assigned action changes state.

Suppose a facility access sample contains an unapproved account. The finding describes the exception and its severity. The remediation owner plans a correction and records the evidence. The action can be Submitted, but that submission cannot verify the action or close the finding. A different reviewer performs a retest. Only Pass closes the finding and verifies the action. Fail or Inconclusive keeps work open.

• One accountable parent. Keep each activity linked to the relevant assessment, risk, control or finding so the next person can follow the same case.
• Named responsibility. Assign the record to the person who prepares the work and keep independent judgement with a separate reviewer where a decision is required.
• Visible outcome. Use the recorded state, result, date and evidence to explain what happened before moving the case forward.

Agree severity use, due-date policy and who may own a corrective action. Set a target completion date when planning the action, then review the date after work finishes. Agree how evidence is retained so the retest reviewer can inspect it without relying on private messages.

Rehearse both a passing and a failed retest. Have the action owner attempt to review their own correction; the independent review should be refused. Confirm that a failed retest leaves the finding open and that the report still shows the prior action and evidence.

Record the retest date and evidence on each attempt so the next reviewer can distinguish an earlier failure from the later passing result.

Follow one access exception from its failed test into a finding with a severity and description. The remediation owner supplies a due date and evidence for the corrective action, then submits it. Ask the independent retest reviewer to inspect that evidence and record a separate result. A failed or inconclusive retest leaves the finding open for further work; only a passing independent retest supports closure and verification.

• Open findings — Unresolved findings grouped by severity and assessment.
• Actions submitted for retest — Corrective actions ready for an independent reviewer.

Follow the related process and check the record definitions.