Repeat Finding Rate
Definition
The percentage of findings in the current audit cycle that were also identified in the prior cycle. A high repeat finding rate signals that remediation is not being completed or verified, and that the programme is cycling through the same weaknesses without improvement.
- Domain
- Audit programme metrics
- Measures
- Findings recurring across cycles
- High value signals
- Poor remediation follow-through
- Used for
- Programme maturity assessment
Common questions
Why is a high repeat finding rate worse than a high total finding count?+
A high total count can reflect thorough testing, but repeat findings mean issues already flagged were never actually fixed or the fix was never verified, pointing to a process failure rather than just risk exposure.
What typically drives a high repeat finding rate?+
Common causes include remediation owners lacking clear deadlines, fixes applied without a verification test, or the same root cause reappearing in newly deployed systems.
Related terms
- Audit Programme Maturity
- The degree to which an organisation's audit activities are systematically planned, resourced, executed, measured, and improved. Maturity is usually described on a...
- CMMC (Cybersecurity Maturity Model Certification)
- A United States Department of Defense framework that certifies defence contractors at one of five tiers of cybersecurity capability. Each tier requires...
- Enterprise Risk Management (ERM) Integration
- The practice of aligning audit planning with the organisation's ERM risk register so that audit coverage tracks actual risk. When the risk...
- Lessons-Learned Review
- A structured post-cycle review that identifies what worked, what failed, and what should change in the next audit cycle. The output is...
- Mean Time to Close (MTTC)
- The average elapsed time between the date a finding is formally reported and the date remediation is verified as complete. MTTC is...