Turn each finding into one ticket with a plain description, a root cause, a named owner, a due date, a fix and a place for proof of closure. Add a second step to confirm the fix works over time. Findings that close with proof are rarely repeated.
Start with understanding the finding
Findings are written in audit language. Rewrite them in engineering terms before assigning work.
Example. Finding text: "For 3 of 25 sampled changes, evidence of approval prior to deployment was not provided." Engineering restatement: "Three production deployments had no approval record linked before release. Find out whether approval happened and was not recorded, or did not happen."
That split matters. A recording gap needs a process or tooling fix. A control gap needs enforcement.
The ticket template
| Field | Content |
|---|---|
| Finding reference | Report number and exact wording |
| Plain description | What was missed, in one or two sentences |
| Root cause | The reason, from a short review, not a guess |
| Corrective action | What fixes the instances found |
| Preventive action | What stops recurrence |
| Owner | One named person |
| Due date | Realistic, agreed with the auditor if needed |
| Evidence of closure | Link or attachment |
| Verification | Who checks it works, and when |
Root cause in 20 minutes
Use a short five whys. Example: deployments lacked approval because the pipeline allowed manual triggers, because it was added for a hotfix, because there was no emergency path, because nobody defined one. The preventive action is an emergency change process, not a reminder to be careful.
Corrective versus preventive
The corrective action deals with what already happened, for instance writing a retro-approval for the three deployments, dated today and labeled as such. The preventive action changes the system. Auditors want both. Do not backdate any record.
Verify, then verify again
- After the fix, test it. Try to repeat the original failure.
- Collect proof from the first live use.
- After one full cycle of the control, such as a month or a quarter, sample again.
- Close the ticket only after that check.
Track the set, not only the ticket
Keep a single list of open findings with owner, due date and status. Review it in a standing meeting. Report overdue ones to the person accountable. A finding that keeps slipping needs attention, not another reminder.
Pitfalls
- Closing on "we told everyone". Awareness alone does not change a system.
- No owner, or an owner who has left.
- Fixing the sampled items and ignoring the population. Check all instances, not only the three found.
Quick check
Should I fix the sampled items only?
No. Check the full population for the same problem, then fix all instances.
When can the ticket close?
After the preventive change is live, proof is attached and a later check shows it working.
Safeguard policies, gates and compliance and evidence automation can help enforce and prove preventive actions. A free scan is available.
Last reviewed: 19 October 2026.
