Findings Management
One remediation queue, not five
A finding is the same object whether it came from an assessment gap, a risk programme, a third-party issue, a control test or a contract obligation — with a maturity score and target, activities with owners, and its full history.
- Origin kept on every finding: assessment response, risk, vendor engagement, due-diligence request, obligation
- Activities with assignees, due dates and dependencies, so blocked work is visibly blocked
- Evidence reviewed and accepted, not merely uploaded
- Open → in progress → pending review → resolved, with overdue escalation
In the application · Assure
- Findings
- Remediation activities
- Evidence review
- Acceptance
- History
Privileged access review not evidenced
Traced to control · raised from assessment
Export current privileged accounts
IT Ops
Confirm owner for each account
System owners
Remove unowned accounts
IT Ops · waiting on “Confirm owner for each account”
Attach review evidence
Security · waiting on “Remove unowned accounts”
Evidence is reviewed and accepted, not just attached
Remediation
Remediation plans are graphs, not checklists
Break a finding into activities, each with an assignee and a due date, and declare which must finish before another can start. Progress is the share of activities done, and maturity is re-scored against the target.
- Activity dependencies and multiple assignees
- Comments on the finding and on each activity
- Activity status distinct from finding status
- Links back to controls, risks, assets and business processes
- PaymentsDomain
- Card acquiringCapability3 risks2 policies
- Merchant settlementService4 controls2 assets
- Daily reconciliationProcess1 risk2 controls1 finding
Every level links out to risks, controls, policies, findings, assessments, and assets
Lifecycle, acceptance and history
Submitted, then reviewed; or accepted, with the rationale
Evidence carries a type and a status and passes through an explicit review step, so closure means someone competent accepted the proof. A finding that will not be fixed can be formally accepted instead, and every change is kept.
- Explicit review records against submitted evidence
- Overdue findings escalated to their owners by the workflow engine
- Accepted findings recorded with rationale and authority
- Full audit log per finding
Level 3: Well Defined
A standard process is defined and followed across the organisation.
Every question in the control library carries its own written descriptor at each level.
Framework alignment
Works with your control frameworks
This module shares the platform control library. International standards, sector regulations and your own internal standard are loaded the same way and mapped to one another, wherever you operate.
Solutions by role
Built for your team
See findings management in your environment
A walkthrough scoped to your entities, your frameworks, and the way your programme is actually run.