Deviation closure
A failed test opens an Issue that closes only by a Decision recording cause, remediation and management’s response.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC4.2 | The entity evaluates internal control deficiencies and communicates them in time to the parties responsible for corrective action. |
| ISO27001 A.5.36 | Compliance with the information security policy, rules and standards is reviewed on a set schedule. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every exception a Control.tested Event reports in the report period. |
| Assert | Each has an Issue at its stakes tier, and each closed Issue cites a Decision with cause, remediation and management’s response. |
Owner
Compliance Officer, Legal Team.
Example
A nightly test finds one refund that skipped its Approval. The Issue closes only after a Decision records the cause, a missing Guard on one Verb, the fix and the officer's response.