At a glance
A new procedure has been published and the implementation task is marked complete. That is progress. Whether the original finding can close depends on what the finding required and whether the change has been shown to work.
- Agree the acceptance test before delivery starts.
- Check fresh evidence from the affected scope.
- Assign any continuing exception and review date.
Return to the original condition
Imagine a fictional assessment found that supplier access removal could not be demonstrated for selected completed engagements. Publishing an updated procedure addresses the intended process. It does not yet show that removals now occur and can be traced.
Read the original finding and its agreed action. The closure decision should address that condition, not a smaller task that was easier to complete. If the original wording was too broad, clarify it transparently rather than quietly changing the success criterion.
Test the changed process
Choose evidence from after the change took effect. For supplier removal, link approved end dates to the corresponding removal records for selected completed engagements. Include relevant exceptions, such as an extended engagement, when designing the check.
Explain the sample and its limits. A targeted check can show whether the change operated in those cases; it cannot prove that every possible case is correct. If a failure appears, investigate its cause and decide whether the check should expand.
Microsoft’s access-review guidance distinguishes reviewing access from applying the resulting decisions. The same practical distinction matters in assurance work: a recorded decision and its operational effect are separate things to verify. Microsoft Learn: What are access reviews?.
Record a closure decision another person can follow
| Record | Why it matters |
|---|---|
| Original finding and scope | Shows which concern the decision addresses. |
| Change made and effective date | Separates the old and new operating conditions. |
| Evidence reviewed | Allows a later reviewer to understand the check. |
| Result and limitations | Prevents a narrow sample becoming a broad assurance claim. |
| Remaining exceptions | Keeps unresolved exposure assigned and reviewable. |
An exception need not disappear from the record when the main improvement is complete. Name its owner, rationale and next review condition. If it leaves material exposure unresolved, the appropriate decision may be partial completion or continued review rather than full closure.
Keep delivery and assurance connected
The people delivering the change should know what evidence the reviewer expects. The reviewer should understand the practical limits of the implementation. Agreeing the check early avoids an end-of-project dispute about whether the work is finished.
In AssessX, linked risks, gaps and roadmap work help maintain that connection. Use the available records to explain why a status changed. A closed task is useful delivery information; the finding’s review should explain whether the intended improvement was demonstrated.
Schedule further review when the process needs time to produce operating evidence. A newly implemented monthly control may require an actual cycle before it can be evaluated. Record that dependency rather than treating the absence of immediate evidence as either failure or automatic success.
References
Primary guidance used for the specific points cited above. The examples, templates and recommended working practices are AIdentX editorial guidance.
Sources reviewed September 2026.
Published by AIdentX Editorial. Illustrative scenarios are fictional and do not represent customer results.