Appearance
Action Plans
Where to find it: Risk Management, then Action Plans (/action-plans).
An Action Plan (ACT-YYYY-NNNN) is a governed commitment to fix something: what will be done, by whom, by when, and how it will be verified.
Why action plans are governed records
A remediation tracked in a spreadsheet has three failure modes: it has no owner who agreed to it, no date anyone is accountable to, and no independent check that the work happened.
An OrviQ action plan closes all three. It has a named owner, an approved plan, a due date, and a verifier who is neither the owner nor the approver.
Lifecycle
| Status | Meaning |
|---|---|
draft | Being written |
pending | Submitted, awaiting approval |
active | Approved and in progress |
blocked | Progress impeded; a reason is recorded |
done | Work reported complete, awaiting verification |
completed | Independently verified |
overdue | Past due date and not complete |
retired | Withdrawn |
The three roles
| Role | Permission | Responsibility |
|---|---|---|
| Owner (Line 1) | action_plan.write | Create, own, submit, start and complete the plan |
| Approver (Line 2) | action_plan.approve | Approve or reject the plan — never their own |
| Verifier | action_plan.verify | Independently verify completed remediation — never their own plan, and never the approver of it |
The three-way separation is deliberate. An approver who can also verify is only two eyes, not six.
What an action plan carries
| Field | Purpose |
|---|---|
| Business reference | ACT-YYYY-NNNN |
| Title and description | What will be done |
| Owner | Who will do it |
| Approver | Who approved the plan |
| Verifier | Who will confirm it |
| Due date | When it is committed for |
| Milestones | Intermediate checkpoints |
| Linked records | The finding, risk, control, requirement, incident or exercise it serves |
| Evidence | Artefacts demonstrating completion |
| Status | Its lifecycle state |
| History | Every transition, with actor and timestamp |
Verification
Verification is the step that distinguishes a governed action plan from a task list.
The verifier confirms that the remediation actually addressed the problem — not that the owner says it did. Where the plan serves a finding raised by a failing indicator, the natural verification is that the indicator now passes.
Verification can fail. A failed verification returns the plan to active with the reason recorded, and where the plan serves an audit finding, a failed retest reopens the finding.
Completing an action does not close what it serves
Completing and verifying an action plan does not close the finding it serves, does not close an incident, and does not convert a failed resilience exercise to passed.
Each of those has its own governed closure requiring its own independent judgement. An action plan is one input to that judgement.
Milestones
Milestones break a long remediation into checkpoints with their own dates. A six-month remediation with no intermediate milestones is a six-month period during which nobody knows whether it is on track.
Deadlines and escalation
Action plan due dates appear on the GRC Calendar and drive reminder and escalation behaviour under your tenant's SLA policy.
Overdue action plans also surface as a risk signal on any risk the plan is linked to as treatment.
Permissions
| Action | Permission |
|---|---|
| View action plans and history | action_plan.read |
| Line 1: create, own, submit, start, complete | action_plan.write |
| Line 2: approve or reject | action_plan.approve |
| Independent verification | action_plan.verify |
All require the compliance_core entitlement.
Example
Action Plan ACT-2026-0188 — Enforce MFA on remaining privileged accounts.
| Field | Value |
|---|---|
| Serves | FND-2026-0071 |
| Owner | IT Security Operations Manager |
| Approver | Compliance Manager |
| Verifier | Senior Compliance Analyst |
| Due date | 30 days |
Milestones:
| Milestone | Date | Outcome |
|---|---|---|
| Identify account owners and dependencies | Day 7 | Met |
| Remediate the two interactive accounts | Day 14 | Met on day 18 |
| Resolve the service account with the vendor | Day 25 | Not met; vendor change request raised |
| Verify indicator passing | Day 30 | Partial |
Outcome: two accounts remediated. The third required a vendor product change outside the 30-day window, so an exception was requested and approved with a 90-day validity and a compensating control.
The plan completed on day 31 and was verified on day 34 — the verifier confirmed the indicator passed for the two remediated accounts and that the third was covered by an approved exception with an expiry date.
A partially achieved plan verified honestly beats a fully closed one that was not
The third milestone was missed. Recording that, and routing the residual gap to a governed exception with an expiry, is a better outcome than marking the plan complete and letting the account quietly persist.
Troubleshooting
"I cannot approve my own action plan." Correct. Line 2 approval requires a different person.
"I cannot verify a plan I approved." Also correct. Verification is independent of both ownership and approval.
"The plan is complete but the finding is still open." That is the closure rule. See Findings.
"An action plan shows overdue after completion." Check its status — done awaiting verification is not completed. Overdue clears on completion, not on reported work.
"Verification failed and the plan reopened." The verifier found the remediation did not address the problem. The reason is on the plan history.