Follow-Up Verification
Definition
An independent check, usually by internal audit or the compliance function, that reviews closure evidence and confirms the control gap has been addressed. Verification may include re-testing the control rather than accepting documentation alone.
- Purpose
- Independently confirms a control gap has actually been closed
- Performed by
- Internal audit or the compliance function
- Scope
- Reviews closure evidence, may re-test the control directly
- Distinguishing feature
- Independent of the party who implemented the fix
Common questions
Why isn't accepting the remediating team's own closure documentation sufficient?+
A team reporting its own fix as complete has an incentive, even unintentionally, to overstate progress or overlook edge cases the remediation did not fully address. An independent reviewer checking evidence, or re-testing the control, catches gaps that self-reported closure would miss.
What distinguishes verification through re-testing from verification through documentation review alone?+
Documentation review confirms that stated actions were taken and paperwork is in order, while re-testing the control directly confirms the control actually functions as intended in practice, which can reveal that a documented fix did not fully resolve the underlying weakness.
What happens if follow-up verification finds the remediation was incomplete?+
The finding is typically reopened or a new finding is raised, and the remediation cycle restarts with corrective action required again, rather than the original item being marked closed based on the incomplete fix.
Related terms
- Closure Evidence
- Documentation that demonstrates a finding has been remediated. Acceptable evidence types vary by control: updated policies with effective dates, configuration screenshots, vulnerability...
- Finding Owner
- The individual or team accountable for implementing the corrective action specified in a management action plan. The finding owner is typically the...
- Management Action Plan (MAP)
- A formal document issued in response to an audit finding, recording the agreed corrective action, the accountable owner, the target closure date,...
- Recurring Finding
- An audit finding that has appeared in two or more consecutive audit cycles despite previous remediation commitments. Recurring findings indicate that the...
- Risk Acceptance
- A formal decision by an authorised senior manager to tolerate a finding without full remediation, typically because the cost of remediation exceeds...