Evidence & method

    Audit & Remediation Board

    Findings close when the control works again — not when a status field changes. Every lane on this board is bound to a control and an evidence specification agreed before remediation starts, so closure means something to an examiner.

    The lanes

    Raised

    Finding captured with source — internal audit, examination, self-identified or third-party assurance.

    Owned

    Named accountable executive assigned. Unowned findings age visibly rather than sitting in a queue.

    In remediation

    Action plan bound to the control it repairs, with an evidence specification agreed up front.

    Evidence submitted

    Remediation evidence attached to the control, not to a status field.

    Independently verified

    Second-line or external verification before closure. Self-closure is not available.

    Closed with attestation

    Closure attested and time-stamped. Reopened findings retain the original clock.

    Ageing has consequences

    An overdue finding is a live control weakness. The board treats it that way, and the consequence is visible in the institution's resilience position rather than buried in a tracker.

    0–30 days
    Within plan
    31–90 days
    Escalation to the accountable executive
    91–180 days
    Reported to the risk committee with a revised date and cause
    180+ days
    Treated as a resilience deterioration and reflected in the ORS position