Finding received
The access rights review does not cover suppliers.
Home / Method and evidence
Method and evidence
Example of a finding trail
From the finding to the commercial impact, the action, the closure evidence and the residual risk.
Question addressed
Carry a finding through to a closure decision founded on evidence.
A poorly handled audit finding hurts twice: at the time of the report, then at renewal, when the client checks what became of it. The finding trace follows a single item end to end: where the finding comes from, whether it is well founded, what it affects, who corrects what, and what proves closure.
The example shown here — provider accounts excluded from an access review nonetheless promised as "complete" — is typical: the control exists, the promise is broader than it, and no one had noticed. The record is not about finding someone to blame; it makes the gap governable.
Closure timeline
A finding is only closed once a decision has been made on the action, the evidence and the residual risk.
Analysis
Sound policy, partial practice, incomplete platform.
Action
Extend the scope and retain the approvals.
Closure
Evidence verified, exception resolved, residual risk accepted.
Decision enabledEach finding becomes a governable case — with a demonstrable close, not an empty promise.
Reading a conclusion
Do not confuse a completed action with a closed finding
Closure requires more than a date or a resolved ticket. The trail shows the initial basis, the correction carried out, the verified evidence, the remaining limitations and the authority accepting the residual risk.
The closure decision rests with the authority specified in the mandate; the example shows the elements needed for it to rule.
Starting questionCarry a finding through to a closure decision founded on evidence.
- 01Basis of the finding
- 024P divergence
- 03Action assigned
Implementation
Make closure as verifiable as the initial finding.
- Basis of the finding
- 4P divergence
- Action assigned
- Closure decision
01
Qualify the basis
Is the finding factually accurate? On what sample, what period, what scope? An inaccurate finding is challenged with evidence; a well-founded finding is owned with a plan.
02
Measure the actual impact
Which engagements, which clients, which deadlines does this finding affect? It is impact — not technical severity — that determines priority.
03
Assign the remediation
One action, one named owner, real dependencies, a tenable deadline. Heroic dates promised in the heat of the moment are the leading cause of recurrence.
04
Prove closure
Closure cites its evidence: export, signed validation or retest. The remaining residual risk is recorded and feeds the corresponding line of the register.
Terms of use
The conditions that prevent a purely declarative closure.
The basis, the correction, the verified evidence and the residual risk must all address the exact finding received from the client or the auditor.
Should we respond quickly or respond accurately?
Both, in this order: a structured acknowledgement within a few days (basis under analysis, governance in place), then the full position. Silence is the worst possible response.
Can a finding be challenged?
Yes, on evidence: misunderstood scope, unrepresentative sample, ignored compensating control. A documented challenge strengthens credibility; a defensive one destroys it.
What should be done with a finding that is accurate but minor?
Accept it, correct it at proportionate cost and trace it. Untraced minor findings return in force at renewal.
Continue reading
Present the findings before settling on a response position.
The findings report can be presented without prematurely announcing acceptance, dispute or a closure date.