Findings and Remediation

A finding records the problem identified in an assessment, the control it concerns, its severity and its current state. The team can assign a corrective action to a named owner with a due date and evidence of completion. This keeps the response attached to the tested control rather than leaving it in an email thread.

A high-severity finding may need immediate attention, but severity alone does not establish that the issue is fixed. The Remediation Owner documents what changed and submits the action for verification. An Independent Assurance Reviewer then records a retest result and evidence. A passing retest gives the team a reason to close the finding. A failed or inconclusive retest sends the issue back for more work.

• Finding. Severity, description, assessment and control define the issue to resolve.
• Corrective action. Due date, owner, status and evidence describe the work being done.
• Independent retest. The reviewer records when the control was tested again, the result and supporting evidence.

Agree who assigns corrective actions and how due dates are set. Decide what evidence demonstrates that a change was made, and what evidence demonstrates that the control now works. Those are different questions. A screenshot of a changed procedure may support the action, while a fresh sample supports the retest.

Set a clear separation between the person completing the action and the reviewer who retests it. Decide how the team treats an inconclusive retest: the finding remains open for a further decision. For a reporting package, agree whether outstanding findings affect the assessment decision or require disclosure in the return preparation handoff.

Start with a failed control test for a branch reconciliation. Record a finding against the same assessment and control, with its severity and a description of the exception. Assign an action with a due date to the person responsible for fixing the process. After the owner enters completion evidence, have a different reviewer take a new sample and record a retest.

Review the record twice: once with a passing retest and once with an inconclusive one. In the first case, the reviewer can support closure. In the second, the team should see the unresolved state and the evidence still needed. The assessment and eventual return should remain traceable to that decision.

• Open findings — Work through findings by severity and current remediation state.
• My corrective actions — Show each owner the actions and due dates assigned to them.
• Actions submitted for verification — Give the reviewer a list of work ready for retest.

Follow the finding and retest process, then continue to return review once the assessment outcome is understood.