Open one record per finding. Link a record for each agreed action and each test. The action owner reports implementation, the reviewer records what the evidence supports, and the person designated under the applicable methodology records the finding’s disposition. Management owns remediation and any risk acceptance within its authority.

Use approved systems for evidence and enter references here. These fields are a suggested template. Agree the review scope, method and decision authority before using it. Where internal audit performs the follow-up, apply its established methodology and record any limits on reviewer independence.

Define what must be true to close the finding

Turn each material part of the finding into a testable criterion. Include affected routes and historical work where they matter. If scope or criteria change, keep the original version, who authorised the change and its effect on earlier results.

What to record Entry or evidence reference
Finding ID, original report and issue date ____________________
Control objective, observed weakness and exposure ____________________
Affected systems, routes, locations and period ____________________
Cause supported by evidence and remaining uncertainty ____________________
Success criteria with IDs, agreed scope and failure conditions ____________________
Accountable manager, reviewer and mandate, and closure authority ____________________
Interim control, owner, evidence, and expiry or review date ____________________

Track the action and its deadlines

Use one record per action. Retain the original due date and each authorised change. Record what remains exposed during a delay. Where an action is replaced, link the replacement and assess whether it covers the same success criteria.

What to record Entry or evidence reference
Action ID, finding ID, criterion IDs and deliverable ____________________
Action owner, original and current authorised due dates ____________________
Date-change history, reasons, authority and interim safeguards ____________________
Management status (Planned, In progress, Reported implemented or Replaced) ____________________
Claimed implementation date and evidence reference ____________________
Replacement action, rationale and authority, if applicable ____________________

Plan the test and retain each result

Plan evidence proportionate to the risk. Distinguish whether the design addresses the weakness, whether it was implemented across the scope, and whether it operated during the period assessed. Where operating evidence is needed and no case occurred, record how the absence was established and what a controlled test can demonstrate. Keep any unsupported operating conclusion pending. Record and investigate material failures before retesting.

What to record Entry or evidence reference
Test ID, linked action and criterion, reviewer and date ____________________
Route or location, period, evidence type and expected result ____________________
Population source and completeness, selection and rationale, exclusions and limitations ____________________
Actual result and evidence reference ____________________
Outcome (Pass, Fail, Inconclusive or Not performed) and scope supported ____________________
Failure exposure, containment owner, corrective action and linked retest ID ____________________

Keep the failed test and its evidence when a retest passes. Treat missing or contradictory evidence as unresolved unless the reviewer can support a narrower conclusion and state its limits.

Record verification and decide the finding’s disposition

Mark the action Pending, Evidence insufficient, Failed verification, or Verified within stated scope. Close after verified remediation only when the evidence supports all material success criteria, including necessary linked actions. Where policy permits a transfer or authorised risk acceptance, record that disposition explicitly and keep the remaining exposure visible. For internal audit, apply the methodology for overdue actions and use the chief audit executive’s escalation route when applicable.

What to record Entry or evidence reference
Reviewer’s conclusion, scope, limitations and linked tests ____________________
Finding disposition (Open, Closed after verified remediation, Closed under authorised risk acceptance or Superseded with linked tracking) ____________________
Decision authority, date, rationale and evidence ____________________
Unresolved exposure, receiving owner and acknowledgement if transferred ____________________
Risk acceptance reference, permitted authority, interim controls and expiry if applicable ____________________
Reopening trigger, monitoring owner and next review ____________________

Worked examples

These examples use fictional data.

Verified across the agreed scope

Finding F-31. The criterion is independent approval on every in-scope payment-change route. Reviewer R-31 checks normal entry and import configuration and tests both in a controlled environment. The reconciled register contains 24 changes in October. Six selected across the two routes show separate approvers. The reviewer records the judgemental selection and links test results T-31 and T-32. The closure authority records verified remediation against those results and the stated selection limits.

The retest passes, but the finding stays open

Finding F-32. T-1 shows a normal-screen control works but the import path permits self-approval. Finance restricts import and fixes permissions. T-2 passes on both routes. The reviewer links T-2 to T-1. The historical review is still due under action A-2, so the closure authority keeps F-32 open with a named owner and review date.

Implementation evidence is available before the first run

Finding F-33. Management supplies a deployment record for a quarterly control. The reviewer confirms the deployment and reconciles the schedule to show the first run is still ahead. Operating evidence is required for criterion C-2. The reviewer records that check as Not performed, assigns a follow-up after the next run, and leaves the finding Open.

Sources behind the workflow