A control failed mid audit period: what to do next

Record the failure with its dates, fix the cause, work out what was affected, and tell your auditor before they find it. A single failure that is found, explained and corrected is a normal event. A hidden one, discovered by sampling, is the kind that harms trust.

Step 1: write down the facts

Capture what failed, when it started, when you noticed, and who noticed. Use system timestamps. Do not guess at the start date: check logs, change history and ticket records.

Keep the record factual. Leave out blame and speculation.

Step 2: contain and fix

Restore the control first. If MFA was off for a group, turn it on. If a review was skipped, run it now. Then find the root cause. Was it a change that reset a setting, a process nobody owned or a tool that stopped collecting?

Fix the cause as well as the symptom, or the failure repeats next quarter.

Step 3: work out the impact

Ask what the gap allowed. Did anything go wrong while the control was down? Check logs for the window. If the control protected customer data, look for unusual access during that time. Record what you checked and what you found, including that you found nothing.

Step 4: tell the auditor

Raise it early and in writing. Give the facts, the fix and the evidence the fix worked. Auditors see failures regularly. What they care about is whether you detect and handle them, because that is itself a control.

How the failure appears in the final report depends on the auditor's judgment and the report type. Do not promise an outcome. Ask how they want to treat it and what extra evidence helps.

Step 5: improve detection

Ask how long the gap lasted before someone noticed. If the answer is weeks, add a check that would have caught it sooner and an alert with an owner. Record this too. It shows the control environment learns.

What not to do

• Do not edit past records to hide the gap.
• Do not backfill evidence and imply it was made then.
• Do not reduce the audit scope after the fact to avoid the issue without discussing it with the auditor.

Continuous checks, such as those in Safeguard's compliance and evidence automation, shorten the time between a failure and its detection. You still need a person to own the response.

Keep the incident record short and complete: the dates, the cause, the fix, the impact check and the auditor conversation, all in one place. If your policy defines a corrective action process, follow it and cite it. Auditors often test whether the failure was handled according to your own written process, so the record doubles as evidence that the response control works.

Quick check

Last reviewed: 19 October 2026.