Compliance · Monitoring · Component

The findings log

Open findings with owner and date, tracked to closure — because a finding raised and not closed is a documented failure.

The deliverable

What it is

Findings accumulate when closure is asserted rather than verified, and an ageing findings log is itself a finding.

The organisation is in a worse position with an open finding than with an undiscovered problem, which is an argument for closing them rather than for not looking.

One level in

What it is made of

Each element is a constituent part of the component. Follow one to see the attributes it carries.

  1. The finding

    What was found, and how serious it is.

    3 attributes: Finding · Severity · Control

    Learn
  2. The action

    What is being done, by whom, and by when.

    3 attributes: Action · Owner · Due

    Learn
  3. The closure

    Verification that the finding was actually resolved.

    3 attributes: Closed · Verified by · Days open

    Learn

Closure asserted by the owner is not closure. Verify it, or the log becomes a list of things that were once mentioned.