A closed action ticket lacks effectiveness evidence
A fictional ISMS audit identifies a documented requirement for timely removal of access after a role ends. The auditee opens a corrective-action ticket, writes a new procedure and marks the ticket closed. The supplied follow-up sample still includes an account whose removal did not occur under the stated requirement, and no evaluation of the underlying workflow cause has been provided. A colleague proposes closing the finding because the ticket is green. Another distinguishes a written correction plan, implementation, cause analysis and demonstrated effectiveness. This written case conducts no real audit and accesses no account. It asks which evidence is still missing and how to communicate a bounded follow-up result without designing the auditee’s entire solution or issuing a certification decision.
1. Why is the closed ticket insufficient?
Read the worked answer
Ticket status and a new procedure do not demonstrate effective operation. The supplied exception and missing cause/effectiveness evidence remain relevant to the actual criterion.
2. What should the auditor do?
Read the worked answer
Document the criterion, observed evidence and remaining gap under the agreed follow-up rules. Review justified corrective-action and effectiveness evidence while preserving independence and the programme’s separate decision responsibilities.