Remediation and Retests

A finding can lead to a corrective action with an owner, due date, status, completion date and evidence. This gives the team a concrete commitment to review after a test reveals an issue. A planned action is different from work in progress; submitted work is ready for verification, while verified work has passed that step. The action remains linked to the finding throughout the sequence.

The retest is a separate record. It names a reviewer, test date, result and evidence, and links back to the finding. That separation helps the Independent Assurance Reviewer make an independent judgment about whether the corrected control now works. A failed or inconclusive retest remains visible while the team decides the next action. The retest result alone does not change the finding or action status.

• Commitment. Assign a corrective action to an owner and record when it is due.
• Submission. Keep completion evidence with the action when the owner submits it.
• Verification. Record a retest result and evidence against the original finding.

Agree who may own an action and who acts as an independent reviewer. Set a standard for evidence that shows the change was completed, and a separate standard for evidence that the control now performs as intended. A due date should support practical follow-up, while a completion date records when the work actually ended. The team also needs a way to respond when a retest fails or cannot reach a conclusion.

Take a high-severity finding from an assessment. The owner proposes the corrective work and due date. When the work is complete, the owner records evidence and submits it. The reviewer then performs a retest and records the result. If the retest passes, the team can consider closing the finding. If it fails, the finding remains in the working queue with its history intact.

Open a finding with a corrective action. Confirm the action owner, due date, status and evidence correspond to the issue described in the finding. Ask the reviewer to locate the original test result and the control before recording a retest. Compare the retest evidence with the action evidence; they answer different questions. The first explains the work performed, while the second supports the independent outcome.

Check what the next owner sees if the due date has passed or the retest is inconclusive. The action and finding statuses should make the remaining work clear. The case should retain the record of the original failure even after a successful retest, allowing the team to explain how the issue was resolved.

• Corrective Actions for Verification — Review submitted action evidence against its finding.
• My Corrective Actions — Follow assigned work by due date and status.
• Retest Results — Compare independent outcomes and supporting evidence.

See remediation and review a rule change.