# Audit findings, root cause and corrective action Closing a finding requires more than attaching a document. Continue Harbor’s payment segregation example through facts, risk, validated cause, ownership and retesting. This guide provides example reporting language, explained alternatives and blank tracking workpapers. Colors and deadlines do not replace evidence; real severity and decision authority follow the organization’s applicable method. Original SecNet educational content with fictional examples, not publication/endorsement by referenced organizations. Page exercise choices last only for the open session; no real organizational data is collected. 2026.10 · 2026-10-23 ## What should I do tomorrow? 1. Separate an observed fact from an unrealized potential effect. 2. Explain how one action addresses a validated cause. 3. Record closure-test scope, pending evidence and decision owner. ## Concepts **Koşul / gözlenen durum** — The state observed with evidence within a defined scope. **Kök neden hipotezi** — A proposed cause expected to explain recurrence that still needs validation. **Düzeltme** — Action addressing the observed error or affected record. **Düzeltici faaliyet** — A change addressing causes or mechanisms to prevent recurrence. **Etkinlik testi** — Testing whether a change delivers expected behavior under suitable scoped conditions. **Kalan risk** — Business exposure and uncertainty remaining after current measures. ## Process map ### 1. Validate facts Auditor + process owner Compare criteria, scope, evidence and uncertainty. Traceable draft finding. ### 2. Investigate cause Management + control owner Test technical and process hypotheses against records. Validated mechanism and open questions. ### 3. Agree the action Authorized management owner Define correction, durable action and acceptance tests. Owned, measurable plan. ### 4. Validate implementation Control owner + assessor Review change scope, tests and compensating controls. Implementation evidence and residual risk. ### 5. Test effectiveness and monitor Independent reviewer + oversight Retest suitable periods and paths; record closure or escalation. Justified status and subsequent monitoring. ## Connect the five parts of a finding At Harbor the criterion requires a second authorized approver other than the payment-file preparer. The condition is verified missing approval in selected files during a defined period. Evidence references controlled file/event records. Risk is the potential for unauthorized or erroneous payments to proceed without independent checking; actual financial loss is asserted only with separate evidence. If cause is not yet known, state that it remains unvalidated. The original finding structure connects criteria, observed condition, status of cause, potential effect and the management decision needed. Include sample count, selection method and period limits. A policy exception, technical weakness and realized incident are different claims. Do not turn an interview statement into an allegation of actual abuse. Use clear language without concealing uncertainty or assigning accusatory personal labels. - [ ] The finding separates fact, potential risk and unvalidated cause. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) ## Do not confuse colors or scanner scores with business impact Significance depends on scope, feasible failure paths, existing compensating controls, business consequences and evidence uncertainty. A technical score is useful input but cannot capture the full effect of a payment-approval finding. Harbor examines service-account processing, approval availability and separate bank checks together. Evaluate compensating controls through scoped operating evidence, not assertion alone. Apply the organization’s approved rating method; this guide imposes no universal traffic-light scheme or closure deadline. Explain comparable ratings across systems. Rating disagreement does not change facts. Preserve management’s counterevidence, reviewer and rationale through authorized review instead of lowering risk to obtain a later deadline. - [ ] Significance is grounded in business impact, compensating evidence and organizational method. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments](https://csrc.nist.gov/pubs/sp/800/30/r1/final) ## Move from human error to the operating mechanism The first explanation for Harbor’s missing approval may be an employee forgot. Treating this as the root cause does not explain recurrence. Why could processing continue without second approval? Did delegated roles use a different rule? Was that path in release tests? Authorized technical and process owners test hypotheses against change and event records. Questioning one person is not a complete systemic cause analysis. In the fictional exercise the delegation check may exist only in the interface, not in the server-side workflow. This is a teaching scenario, not a claim about a real vulnerability. Missing acceptance tests or unclear ownership may contribute; validate each separately. Tools such as repeated why questions structure thinking without automatically proving answers. - [ ] Each cause hypothesis has supporting/contradicting evidence and validation status. Reference: [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final), [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) ## Separate correction, durable action and acceptance testing Authorized review of the files with missing approvals corrects the observed records. Enforcing segregation in the server-side delegation workflow and adding release tests addresses recurrence. Training can help some causes but cannot alone enforce a technically bypassable control. Completion percentages can mislead when an action does not explain its connection to risk. The plan identifies an accountable management owner, implementers, dependencies, authorized target date, interim compensation and closure criteria. An example criterion blocks the same actor from both steps on one file while allowing a different authorized actor. Test legitimate paths as well as prohibited behavior. Use existing change authorization and rollback planning for release. - [ ] The action addresses a validated cause and both positive and negative acceptance tests. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) ## Implemented and operating effectively are different states A remediation ticket and test-environment screen provide implementation evidence. Deployment to the target production version, coverage of relevant roles and suitable operating evidence need separate evaluation. When a change is too recent for an operating period, preserve that visible state. Awaiting test, awaiting operating evidence and verified closure can be tracked separately. These status labels are original tracking examples and can be adapted to organizational tools while preserving meaning. Do not count pending operation as closure merely to reduce open findings. Management owns implementation; assessors own evidence-supported conclusions. Closure records identify date, scope, method, review and remaining limits. Automatic ticket closure cannot substitute for assessment. Status and evidence in the original tracking example | State | What it establishes | Next evidence | | --- | --- | --- | | Planned | Owner and agreed action | Implementation and scope record | | Implemented, test pending | Record of a change | Relevant path and period test | | Effectiveness verified | Successful scoped retest | Residual limits and monitoring decision | | Time-bound risk acceptance | Authorized residual-risk decision | Condition tracking and reassessment at expiry | - [ ] Implementation, retest and effectiveness evidence have distinct statuses. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) ## Keep delay, risk acceptance and escalation visible On delay, retain the original date and record cause, elapsed time, business effect, compensation and the new decision requested. If Harbor awaits a supplier release, identify which payment path remains exposed and which independent check operates. Escalation follows organizational significance and authority, rather than treating every delay identically. Silent extension is not evidence of risk management. Authorized management may accept residual risk, but acceptance does not establish remediation or effective control operation. Link scope, duration, conditions and reassessment to the finding. Auditors do not automatically accept business risk on management’s behalf. Risk acceptance does not itself waive legal or contractual duties; involve authorized legal/compliance assessment where needed. - [ ] Delay and risk acceptance are tracked separately from remediation. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments](https://csrc.nist.gov/pubs/sp/800/30/r1/final) ## Turn recurring findings into management learning If Harbor sees a similar delegation failure again, investigate the previous closure test, assumptions broken by a later change and gaps in release coverage. Define whether recurrence metrics count the same finding, same cause or another service. When definitions change, disclose the limit on comparisons with earlier periods. Executive reporting shows high-impact open paths, aging exposure, verified closures and pending operating evidence rather than only counts. State the decision needed: resources, priority, temporary constraints or independent review. Avoid public blame or competitive team scores. Improvement means evidenced reduction of failure paths, not disappearance of records. - [ ] Recurring causes, closure limits and management decisions are reported. Reference: [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011), [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/) ## Common mistakes and better approaches **A document upload closes a finding.** — Validate implementation and effectiveness against defined criteria. **Human error is a sufficient root cause.** — Investigate the recurring mechanism and supporting evidence. **Risk acceptance fixes the control.** — Track time-bound management decisions separately from remediation. ## Decision examples and explained answers ### Training delivered: close the finding? The fictional delegation path does not enforce second approval server-side. Staff delivered awareness training and an attendance list. **Close because attendance reached 100%.** — Revisit Attendance proves participation, not enforcement of a bypassable workflow. Even when training gaps contribute, validate cause and effectiveness separately. **Require action and acceptance tests addressing technical and process causes.** — Supported approach Connecting action to the failure mechanism addresses recurrence. Scoped tests of prohibited and legitimate paths provide stronger closure evidence than activity completion alone. ### Ticket closed, operation pending The rule reached production this morning. The ticket is closed, but there is not yet suitable operating evidence for the scoped delegation path. **Close the audit finding because the ticket is closed.** — Revisit Ticket status reflects a management workflow. Whether the criterion operates across the relevant scope and period is a separate claim that automatic closure cannot establish. **Record implementation and retain pending effectiveness verification.** — Supported approach Recognize implementation progress while making pending evidence visible. Retest and review under predefined suitable conditions before a justified conclusion. ### Management accepted the risk An authorized business owner signed a six-month limited risk acceptance; control behavior is unchanged. **Report the issue as remediated.** — Revisit Risk acceptance is neither a technical correction nor an effectiveness test. Remediated implies changed control behavior and conceals continuing exposure. **Keep the time-bound risk decision distinct and track conditions and reassessment.** — Supported approach Visible scope, duration and conditions make residual exposure manageable. Reassessment is needed at expiry, and acceptance does not automatically remove applicable obligations. ## Official references - [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011) — Official scope and edition record for the May 2026 guidance standard. This package does not reproduce its text or a licensed checklist; ISO 19011 is not itself a certification standard. - [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/) — Official entry point for professional standards effective 9 January 2025. These original workpapers are not an IIA publication, authorization or professional credential. - [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) — Reference for control-assessment methods; the publication page’s 2025 Release 5.2.0 update was also checked. Examples are not a NIST assessment or automated compliance decision. - [NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments](https://csrc.nist.gov/pubs/sp/800/30/r1/final) — Risk-assessment context; example priorities and decision scales are fictional SecNet choices, not universal thresholds. - [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) — Dated foundational reference for planning, authorization boundaries and analysis of technical assessments. Historical tool examples are not treated as current tool recommendations.