Twelve findings and a purchase-order corrective action

Decision rules. A nonconformity is major where the failure is systemic, or where it defeats the ability of the ANF or management process to deliver the targeted trust level for the applications in scope, or where it recurs. It is minor where the process exists and largely works but a defined requirement was not met in an isolated instance, with no direct effect on control effectiveness. An observation is a risk or weakness with no breached requirement. Repeat status and direct effect on the declared trust level raise severity; documentation gaps with demonstrable effectiveness lower it.

(a) Obsolete ASCs with no version history - major. The effect is direct: three controls reference components that no longer exist, so any verification evidence attached to them is invalid, and without version history the auditor cannot establish what was in force at any release. The absence of version control is systemic, not an isolated slip.

(b) Library review 8 months overdue, no recorded deferral - major. The process is defined and was not executed, and the review is precisely the trigger that would have caught (a). Treat (a) and (b) as one nonconformity with two conditions if root-cause analysis shows a common cause; report them together to avoid double-counting and to keep the corrective action coherent.

(c) Vacant role, tasks performed informally - minor. The work is being done and evidence of four approvals exists, so control effectiveness is not directly defeated. The breached requirement is the defined authority and accountability, which is a governance gap. Add an observation on succession and key-person risk, because if the senior developer leaves the approvals stop.

(d) Key rotation verified but not validated - depends, and say so explicitly. If operational evidence shows rotation actually occurs (key inventory, rotation logs, successful decryption after rotation), the gap is in the validation record and is minor. If rotation has never been exercised, the control's fitness for purpose is unproven for an application protecting tax data, and it is major. Do not guess; state the decision rule and the evidence needed.

Evaluation. Purchasing a static analysis tool is a correction measure at best, and it addresses none of the four conditions. (a) needs version control of the ASC library, not a code scanner. (b) needs a review trigger that fires reliably, not a scanner. (c) needs an accountable role, not a scanner. (d) needs validation of key rotation in operation, which no scanner performs. The plan contains no root-cause analysis, so it is a purchase order dressed as a corrective action, and it will produce a finding that recurs at the next audit.

What the plan must contain.

• Root cause analysis for each nonconformity, taken to a controllable cause: for example no nominated owner of the ASC library, no calendar or event trigger for reviews, no tooling for version history, and role vacancy not covered by a documented deputy arrangement.
• Correction: immediate re-review of all 40 ASCs, invalidation and re-verification of the three obsolete controls, and a retrospective impact assessment of releases made while the ASC set was stale.
• Corrective action addressing cause: version-controlled ASC repository with change records; review trigger tied to both a schedule and library-changing events; named owner and deputy with delegated authority; a validation step in the life cycle for controls that require operational evidence.
• Owners, target dates and resources, with evidence artefacts defined per action.
• Risk acceptance, signed by an accountable manager, for any interval before the actions close.

Effectiveness verification. Action completion is not effectiveness. After an agreed interval (say three months), sample 15 ASCs and confirm each has version history and a current review date; confirm the review actually occurred on schedule without the auditor prompting; confirm approvals were made by the named role or deputy; and re-test one key rotation end to end. Report effectiveness separately from closure of the actions.

The response is courteous, immediate and unambiguous: severity is set by criteria and evidence, and a commercial consequence is not an audit criterion. Softening a major nonconformity into an observation without new evidence would make the report misleading, which is the one outcome an independent auditor cannot accept.

What can legitimately be offered.

• Precision: re-check that each finding is stated with condition, criteria, evidence, effect and an accurately graded severity, and remove any rhetorical language. Many 'harshness' complaints are really about tone and about findings that assert more than the evidence shows.
• Context: allow a management response to sit alongside each finding, and agree a factual accuracy review so the auditee can correct errors of fact before issue.
• Recognition: if corrective actions have already started, record them accurately as management action in progress.

What cannot be offered. Downgrading a major nonconformity, omitting a finding, or delaying the report to suit a contract timetable.

Documentation. Record the request in the engagement file with date, attendees and verbatim wording; note the criteria applied and that no change to grading resulted; notify the engagement quality reviewer or partner under the firm's independence and objectivity procedure; and, if the request constitutes an attempt to influence the audit conclusion, consider whether it must be communicated to those charged with governance. If the sponsor persists to the point where the report cannot be issued accurately, the correct outcome is to decline to issue rather than to issue a misleading document - and to say so at the time, not after the fact.