What a closed finding needs beyond a green tracker row
Why remediation trackers overstate closure — and what evidence a follow-up audit actually looks for.
A green row on a remediation tracker often means someone believes the work is done. A follow-up audit asks a narrower question: can we see the control operating on a sample after the promised fix date?
Assertion versus evidence
Policy updates, training slides, and email announcements are necessary steps. They are rarely sufficient on their own. For a payables cut-off finding, we still want invoices around month-end. For access removal, we want an extract dated after the change, not only a ticket screenshot from the day of the request.
Timing matters
If remediation was marked complete on 15 May, samples drawn only from April do not test the new state. We set the sample window after the stated completion date unless the finding was about historical correction of a specific population.
Partial closure is not failure
Committees make better decisions when partial closure is labelled honestly. A control that works at head office but not at a warehouse site is not “closed with comments” — it is partially closed with a residual location risk.
Practical takeaway
Before inviting a follow-up, walk each green row and ask: what sample would convince a sceptical committee member? If the answer is thin, fix the evidence trail first.