Failed test to finding

Step by step

1. Choose control Control Owner

   Control Owner identifies the active control and its risk.

   • Identify control
   • Updates Controls, Risks

2. Record test Control Owner

   Control Owner records the sample, exceptions, result and evidence reference.

   • Capture result
   • Updates Assessment tests, Assessments

3. Raise finding Control Owner

   Control Owner records severity and a description against the assessment and control.

   • State deficiency
   • Updates Findings, Controls

4. Assign action Control Owner

   Control Owner names an action owner and due date.

   • Plan correction
   • Updates Corrective actions, Team members

5. Review evidence Independent Assurance Reviewer

   Independent Assurance Reviewer checks the failed test and action evidence before later retesting.

   • Assess evidence
   • Updates Assessment tests, Findings, Corrective actions

Control Owner

Prepares records; Independent Assurance Reviewer decides and reconciles evidence; Auditor reads the authorized history; App Administrator maintains organization access.