Audit findings, root cause and corrective action

At Harbor the criterion requires a second authorized approver other than the payment-file preparer. The condition is verified missing approval in selected files during a defined period. Evidence references controlled file/event records. Risk is the potential for unauthorized or erroneous payments to proceed without independent checking; actual financial loss is asserted only with separate evidence. If cause is not yet known, state that it remains unvalidated.

The original finding structure connects criteria, observed condition, status of cause, potential effect and the management decision needed. Include sample count, selection method and period limits. A policy exception, technical weakness and realized incident are different claims. Do not turn an interview statement into an allegation of actual abuse. Use clear language without concealing uncertainty or assigning accusatory personal labels.

Related primary references: The IIA — Global Internal Audit Standards (2024) ↗NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗

Significance depends on scope, feasible failure paths, existing compensating controls, business consequences and evidence uncertainty. A technical score is useful input but cannot capture the full effect of a payment-approval finding. Harbor examines service-account processing, approval availability and separate bank checks together. Evaluate compensating controls through scoped operating evidence, not assertion alone.

Apply the organization’s approved rating method; this guide imposes no universal traffic-light scheme or closure deadline. Explain comparable ratings across systems. Rating disagreement does not change facts. Preserve management’s counterevidence, reviewer and rationale through authorized review instead of lowering risk to obtain a later deadline.

Related primary references: NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments ↗The IIA — Global Internal Audit Standards (2024) ↗

The first explanation for Harbor’s missing approval may be an employee forgot. Treating this as the root cause does not explain recurrence. Why could processing continue without second approval? Did delegated roles use a different rule? Was that path in release tests? Authorized technical and process owners test hypotheses against change and event records. Questioning one person is not a complete systemic cause analysis.

In the fictional exercise the delegation check may exist only in the interface, not in the server-side workflow. This is a teaching scenario, not a claim about a real vulnerability. Missing acceptance tests or unclear ownership may contribute; validate each separately. Tools such as repeated why questions structure thinking without automatically proving answers.

Related primary references: NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment ↗

Authorized review of the files with missing approvals corrects the observed records. Enforcing segregation in the server-side delegation workflow and adding release tests addresses recurrence. Training can help some causes but cannot alone enforce a technically bypassable control. Completion percentages can mislead when an action does not explain its connection to risk.

The plan identifies an accountable management owner, implementers, dependencies, authorized target date, interim compensation and closure criteria. An example criterion blocks the same actor from both steps on one file while allowing a different authorized actor. Test legitimate paths as well as prohibited behavior. Use existing change authorization and rollback planning for release.

Related primary references: The IIA — Global Internal Audit Standards (2024) ↗NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment ↗

A remediation ticket and test-environment screen provide implementation evidence. Deployment to the target production version, coverage of relevant roles and suitable operating evidence need separate evaluation. When a change is too recent for an operating period, preserve that visible state. Awaiting test, awaiting operating evidence and verified closure can be tracked separately.

These status labels are original tracking examples and can be adapted to organizational tools while preserving meaning. Do not count pending operation as closure merely to reduce open findings. Management owns implementation; assessors own evidence-supported conclusions. Closure records identify date, scope, method, review and remaining limits. Automatic ticket closure cannot substitute for assessment.

Related primary references: NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗The IIA — Global Internal Audit Standards (2024) ↗

On delay, retain the original date and record cause, elapsed time, business effect, compensation and the new decision requested. If Harbor awaits a supplier release, identify which payment path remains exposed and which independent check operates. Escalation follows organizational significance and authority, rather than treating every delay identically. Silent extension is not evidence of risk management.

Authorized management may accept residual risk, but acceptance does not establish remediation or effective control operation. Link scope, duration, conditions and reassessment to the finding. Auditors do not automatically accept business risk on management’s behalf. Risk acceptance does not itself waive legal or contractual duties; involve authorized legal/compliance assessment where needed.

Related primary references: NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments ↗The IIA — Global Internal Audit Standards (2024) ↗

If Harbor sees a similar delegation failure again, investigate the previous closure test, assumptions broken by a later change and gaps in release coverage. Define whether recurrence metrics count the same finding, same cause or another service. When definitions change, disclose the limit on comparisons with earlier periods.

Executive reporting shows high-impact open paths, aging exposure, verified closures and pending operating evidence rather than only counts. State the decision needed: resources, priority, temporary constraints or independent review. Avoid public blame or competitive team scores. Improvement means evidenced reduction of failure paths, not disappearance of records.

Related primary references: ISO 19011:2026 — Guidelines for auditing management systems ↗The IIA — Global Internal Audit Standards (2024) ↗