After a reorganization, SCA findings often keep pointing at teams that no longer exist, and exceptions keep their old approvers. Fix it by remapping owners from the source of truth, reassigning open findings in bulk, and re-approving exceptions whose approver changed. Do this within days, not quarters.
What breaks first
Reorgs rarely touch code on day one, but they change who is on call and who reviews. Three things go stale quickly:
- Routing. Alerts go to a team channel that is now archived.
- Approvals. Exceptions list an approver who changed roles.
- Policy scope. A repo moved to a different business unit but keeps the old unit's policy, or the reverse.
CODEOWNERS shows how silent this can be. GitHub notes that nonexistent users or teams, or those without write access, are not assigned, and lines with invalid syntax are skipped (see Sources). A deleted team leaves a line that looks fine and routes to nobody.
A seven step reorg checklist
- Freeze the old mapping. Export current repo to team assignments and open finding owners so you can diff later.
- Update the source of truth first. Service catalog entries, identity groups and CODEOWNERS. The SCA tool should read from these, not hold its own copy.
- Resync ownership. Trigger a re-resolve of owners for all affected repos.
- Reassign open findings in bulk. By repo or by label, not one at a time.
- Review exceptions. For each active exception, confirm the approver still has authority. Re-approve or let expire.
- Check policy scope. Confirm every moved repo inherits the new unit's policy.
- Report unowned findings. Anything with no resolvable owner goes to a named triage owner with a deadline.
What to measure afterward
| Metric | Target after a reorg |
|---|---|
| Findings with no owner | Trending to zero within two weeks |
| Findings assigned to deleted teams | Zero |
| Exceptions with a departed approver | Zero |
| Repos with a policy mismatch | Zero |
If your tool cannot produce these four counts, it will be hard to run a reorg cleanly.
Questions for a vendor
- Does ownership resolve at scan time or is it copied once?
- Can I bulk reassign by label, team or path?
- Does an exception record its approver and trigger review when they leave?
- Is there a report of findings assigned to inactive teams?
Reduce the pain next time
Keep structure shallow and use labels, as in modeling teams, products and repos in an SCA tool. Review ownership quarterly even without a reorg, because attrition causes the same drift.
For incoming and outgoing people, ensure tokens and access end together; see a monthly contractor access review with the audit log.
Communication
Tell the receiving team what they inherited: counts by severity, the oldest finding, active exceptions, and any gates that will now apply. A short handover note beats a surprise failed build.
Safeguard's asset discovery and compliance and evidence automation help show current ownership and approvals. A free scan at gold.safeguard.sh/scan can refresh your inventory after a big move.
Quick check
Should exceptions survive a reorg?
Only if the approver and the reason still stand. Re-approve or let them expire on schedule.
How fast should we remap ownership?
Within days. Stale routing lets new findings age unseen.
Sources
Last reviewed: 19 October 2026.
