Closing a major finding with a screenshot and a reminder email
At the closing meeting of an internal audit of a payment processor, you present a major nonconformity: 14 of 30 leavers sampled still had active VPN accounts 10 days after their exit date, and 3 had logged in after leaving. The HR director says the accounts were disabled the same afternoon and sends a screenshot of the identity console showing all 14 disabled. The IT manager says the root cause is 'HR being late with the leaver form' and proposes a reminder email. The audit report is due in 5 working days. Two of the seven findings are disputed: one on logging retention, where the team says the standard does not require 12 months, and one on supplier reviews, where the supplier manager says the review was done verbally. Your audit charter requires corrective action verification within 90 days and escalation of overdue actions to the audit committee.
1. Distinguish the correction from the corrective action in the leaver finding. Assess whether the evidence and proposed action are sufficient to close the major nonconformity.
Read the worked answer
Disabling the 14 accounts is the correction: it removes the immediate condition for those individuals. It does not address why 14 of 30 leavers retained access for 10 days, or why three could log in after leaving. The corrective action must address the cause and prevent recurrence. A reminder email assumes the cause is individual lateness, but the sample suggests a process design failure: no automated trigger from HR to identity management, no reconciliation between the HR system and active accounts, no manager attestation, and no monitoring of disable timeliness. The IT manager's root cause is therefore incomplete.
The screenshot proves the correction only. To close the major nonconformity I would require a root cause analysis covering the HR-to-IT handoff, the identity provisioning process and detection controls; a revised procedure with defined timeliness; evidence of an automated or reconciled disable process; a retrospective check of all leavers in the period, not just the sample; and a named owner with a due date. I would verify effectiveness after 90 days by sampling new leavers and testing disable dates and logons, not by accepting a policy or a screenshot. Until then the finding remains open, with the correction acknowledged.
2. How would you handle the two disputed findings and what should the report say?
Read the worked answer
For the logging finding, I would return to the criteria. If the ISMS, legal, regulatory or contractual requirements do not specify 12 months, I cannot invent that figure. I would check the logging policy, retention schedule, incident investigation needs and any payment-sector obligation. If no requirement exists but 12 months is a risk-based expectation, the finding should be reframed as a risk or improvement opportunity, not a nonconformity. If a requirement does exist, I would cite it precisely and show the evidence gap. For the supplier review, a verbal review can be acceptable if the organisation's procedure permits it and there is corroborating evidence such as meeting notes, emails, actions or risk decisions. If nothing is documented, the finding stands, but the wording should address the absence of evidence and the procedure's own record requirement, not merely the absence of a meeting.
The report should state criteria, condition, evidence and effect for each finding, and record the auditee's position fairly. I would not withdraw a finding just because it is disputed, nor keep one that the evidence does not support. I would discuss the revised wording with the auditee before issue. For overdue corrective actions, the charter requires escalation to the audit committee, so the report should include owners, due dates and the escalation route.