Findings and Retests

Step by step

1. Record findings Control Tester

   The Control Tester identifies the failing control, assessment and severity, with a description of the observed issue.

   • Identifies the issue and tested control
   • Updates Findings, Assessment tests, Controls

2. Assign corrective work Control Owner

   The Control Owner assigns a corrective actions record to a Remediation Owner and sets a due date.

   • Names the owner, deadline and required evidence
   • Updates Corrective actions, Findings

3. Retest the finding Independent Assurance Reviewer

   The Independent Assurance Reviewer tests the corrected control and records a result with evidence.

   • Records an independent result and evidence
   • Updates Retests, Findings, Corrective actions
   ApprovalA person approves before the work moves on.

4. Verify completion Control Owner

   A passing retest supports closing the finding; a failed or inconclusive result stays available for more work.

   • Keeps the assessment outcome tied to the finding state
   • Updates Findings, Assessments

Control Tester

, Control Owner, Remediation Owner, Independent Assurance Reviewer