# Deviation closure

URL: /systems/trust-and-governance/controls/deviation-closure · Id: `control:deviation-closure`

> A failed test opens an Issue that closes only by a Decision recording cause, remediation and management’s response.

A failed test opens an [Issue](/business/nouns/issue) that closes only by a [Decision](/business/nouns/decision) recording cause, remediation and management’s response.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC4.2](/systems/trust-and-governance/criteria/soc2/cc4-2) | The entity evaluates internal control deficiencies and communicates them in time to the parties responsible for corrective action. |
| [ISO27001 A.5.36](/systems/trust-and-governance/criteria/iso27001/a-5-36) | Compliance with the information security policy, rules and standards is reviewed on a set schedule. |

## Implemented by
- [Compliance](/workflows/processes/compliance)
- [Control testing](/workflows/processes/compliance/evidence-collection)
- [Compliance](/systems/compliance)
- [Projects](/code/systems/projects)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every exception a `Control.tested` Event reports in the report period. |
| Assert | Each has an Issue at its stakes tier, and each closed Issue cites a Decision with cause, remediation and management’s response. |

## Owner
[Compliance Officer](/agents/legal/compliance-officer), [Legal Team](/agents/legal).

## Example
A nightly test finds one refund that skipped its [Approval](/business/nouns/approval). The Issue closes only after a Decision records the cause, a missing [Guard](/business/nouns/guard) on one [Verb](/business/nouns/verb), the fix and the officer's response.