Appearance
Audit Findings
Audit findings are canonical findings (FND-YYYY-NNNN) — the same record type the rest of OrviQ uses — with additional audit context and an additional closure requirement.
Canonical, not separate
An audit finding is not held in an audit-only register. It goes into the Findings register alongside findings from compliance assessment, RCSA, third-party risk, incidents and inspections.
This matters practically. A business owner sees one list of what they owe, not four. A remediation programme covers everything. And a control that fails audit testing, RCSA and continuous assurance produces findings that can be seen together rather than in three silos.
Audit findings carry additional context:
| Field | Purpose |
|---|---|
| Audit engagement | Which engagement raised it |
| Audit procedure | Which test found it |
| Audit validation status | The retest state |
| Audit validation notes | The retest conclusion |
| Audit validated by and at | Who retested, and when |
The retest rule
Remediation completion does not close an audit finding
Closing an audit finding requires governed auditor retest validation. The auditor confirms the remediation actually worked.
Marking an action plan complete does not close the finding. Nor does the auditee stating the issue is resolved.
Validation states
| State | Meaning |
|---|---|
pending_validation | Remediation reported; retest outstanding |
validated_closed | Retest passed; the finding is genuinely closed |
reopened_failed_retest | Retest failed; the finding is reopened |
The third state is the one that justifies the whole mechanism. A finding that reopens after failed retest is a finding that would otherwise have been reported as closed while the underlying issue persisted.
Requires audit.finding_validate.
The remediation flow
Note the two independent verifications: the action plan's own verifier confirms the remediation was done, and the auditor confirms it worked. They answer different questions.
Management response
The auditee records a management response: whether they accept the finding, what they will do, who owns it and by when. That commitment becomes an action plan.
A management response disagreeing with a finding is a legitimate outcome and is recorded as such. Resolving the disagreement is a matter for the audit committee, not for the platform.
Severity and prioritisation
Audit findings carry severity, and severity drives the closure authority required and the escalation path. Critical and high findings typically require compliance-level closure rather than departmental.
Permissions
| Action | Permission |
|---|---|
| View findings and their timeline | finding.read |
| Line 1 remediation | finding.remediate |
| Line 2 review, accept, dismiss, close | finding.review |
| Auditor retest validation | audit.finding_validate |
| Manage the action plan | action_plan.write |
| Approve the action plan | action_plan.approve |
| Verify the action plan | action_plan.verify |
Audit validation additionally requires the audit_management entitlement.
Example
Finding FND-2026-0119 — Privileged access exceptions not removed.
| Field | Value |
|---|---|
| Raised in | AUD-2026-0003, procedure 4 |
| Severity | High |
| Description | Two privileged access exceptions identified during Q2 and Q3 recertification remained active at the time of testing |
| Auditee owner | Head of IT Security |
Management response: "Accepted. Both accounts relate to a decommissioned application whose access was not removed when the application was retired. We will remove both within 10 working days and add an access-removal step to the application decommissioning checklist."
Action plan ACT-2026-0211: two milestones — remove the accounts, amend the decommissioning procedure. Completed on day 9, verified on day 12.
Auditor retest, day 21: the auditor confirms the accounts are removed. Reviewing the amended decommissioning procedure, the auditor finds it addresses access removal for applications but not for infrastructure decommissioning, which was the actual root cause for one of the two accounts.
Result: reopened_failed_retest, with the note: "Account removal confirmed. However the procedural remediation does not address infrastructure decommissioning, which was the origin of one of the two exceptions. The recurrence risk is not addressed."
A second action plan was raised. The finding closed at retest three weeks later.
This is why retest is separate from verification
The action plan verifier correctly confirmed the two accounts were removed — that was the plan, and it was done. The auditor asked a different question: will this happen again? Only the second question closes an audit finding.
Troubleshooting
"The action plan is verified but the finding is still open." Auditor retest validation is outstanding. That is the closure requirement.
"A finding reopened after I closed it." Retest failed. The auditor's notes explain why.
"I cannot validate a finding." Requires audit.finding_validate and the audit_management entitlement.
"Audit findings appear in the main findings register." Correct. They are canonical findings with audit context.