Findings and remediation

A finding links an assessment to the control that failed and records severity, description, opening date and status. The corrective action links to that finding, names an owner, and carries due date, completion date, evidence and its own status. These records keep a planned response separate from a verified outcome.

An independent retest records the finding, reviewer, test date, evidence and result. A passing retest can support closing the finding and verifying the action. A failed or inconclusive retest keeps the question open for the reviewer. Action completion is therefore a handoff for assurance, not proof that the underlying control is effective.

• Describe the deficiency. Link each finding to the assessment and control with its severity.
• Assign the correction. Give the action a team member, due date and evidence of work done.
• Retest separately. Record an independent result before verifying an action or closing a finding.

Agree how the Control Owner describes severity and when an action moves from planned to submitted. Name the Independent Assurance Reviewer who will perform the retest, and decide how a failed or inconclusive result goes back to the action owner. Keep the finding and action identifiers together during handoff. Confirm that a completion date alone cannot verify the action or close the finding.

Open a high severity finding against a failed control test and assign a corrective action with a due date. Have the Control Owner submit the evidence of correction, then ask the Independent Assurance Reviewer to record an inconclusive retest. The finding should remain open for further work. Repeat with a passing independent retest and inspect the finding and action statuses together. The Auditor should be able to see both retest results and the evidence behind the final closure.

• Open findings — Group active deficiencies by severity and assessment.
• Actions awaiting verification — Show submitted action evidence that needs independent review.

Rehearse a correction that is submitted before the due date but receives an inconclusive retest. The action owner can see that work was supplied, while the reviewer can keep the finding open pending stronger evidence. This distinction prevents an administrative completion date from being mistaken for assurance that the control now works.

For a failed retest, record the new result and evidence on the retest. The Control Owner can then revise the corrective action while the original finding remains visible to the reviewer.

See the related process and the record model before agreeing the pilot.