Findings and actions

A finding records the exception that needs a response. It ties a description and severity to the assessment and tested control. The open date shows when the issue entered the work queue. The Compliance Manager can use severity and status to see what is still unresolved, while the Assessment Owner can follow the issue back to the assessment that produced it.

The corrective action is a separate working record. It names the finding, a Remediation Owner, a due date, completion date, evidence and its own status. Keeping the action separate lets the team see whether work is planned, in progress, submitted or verified without rewriting the original finding. A submitted action is ready for examination; the independent retest determines whether the issue has actually been addressed.

Suppose a test finds missing support for exception hours in one business unit. The finding describes the observed gap and assigns its severity. The Remediation Owner documents the correction and supporting evidence with a due date. The Compliance Manager can see the finding while the action is under way. The Retest Reviewer later checks the evidence against the finding, rather than accepting the owner’s completed date as proof.

• Finding. Record severity, source assessment, tested control and description together.
• Action. Give each correction a named owner, due date and evidence.
• Verification. Send submitted work to a separate reviewer for a retest.

Agree how severity is applied and when a finding is opened from a failed or inconclusive test. Set due dates in a way the Remediation Owner can act on, and decide who checks submitted evidence. A completed date should mean the owner finished the action; verification remains a separate step. Preserve the original description when the correction changes course.

Create one finding from a representative failed test. Assign an action and move it through planned, in progress and submitted states. Ask another person to locate the linked assessment, control and evidence. The Compliance Manager should be able to tell which issue is still open and which action is waiting for verification, without treating the submitted action as a closed finding.

• Open findings by severity — Open issues grouped by severity and linked to their source assessment.
• My corrective actions — Assigned corrections with due dates and current status.
• Actions awaiting verification — Submitted actions awaiting an independent check.

Follow the related process, review the data model and agree implementation steps with the team.