Closure Attestation with Untested Security Controls and Unencrypted Data
You lead a consulting engagement to implement a claims-processing platform for a regional insurer. The final acceptance certificate is ready, and your firm has booked the $420,000 final payment. A team member reports that the client’s testing environment still stores 12,000 member records in an unencrypted shared drive, and two mandatory security controls were never tested. The client sponsor says the issue is an operational matter and asks you to sign closure so the invoice can be paid; the work will be fixed “sometime next quarter.” Your engagement letter requires all acceptance criteria to be met before closure, and your firm’s code of conduct requires reporting data privacy incidents. The sponsor is also a reference customer for a larger opportunity. The project charter lists security control validation as an acceptance criterion.
1. What professional responsibility and closure issues does this situation raise? What should you do first?
Read the worked answer
This raises professional responsibility, acceptance integrity, and data-privacy issues. The acceptance certificate would attest that criteria are met, but two mandatory security controls were never tested and 12,000 member records sit unencrypted. Signing would be a false certification and could conceal a reportable privacy incident. The first actions are: do not sign; verify the facts with the team member and preserve evidence; notify my firm’s privacy/security and legal leads immediately; notify the client’s privacy officer or equivalent; and protect the data-recommend containment, access restriction, and encryption. I would also check the engagement letter and code of conduct for mandatory reporting. The sponsor’s reference-customer status and the $420,000 payment are commercial pressures, not valid reasons to certify. I would separate the commercial conversation from the acceptance decision and escalate internally if the firm pressures me to sign. Professional responsibility requires putting the client’s data subjects and the integrity of the attestation ahead of revenue.
2. How should you handle the sponsor’s request and the final payment? Draft the key messages.
Read the worked answer
To the sponsor: “I cannot sign the acceptance certificate because two mandatory controls are untested and member data is unencrypted. We will support remediation immediately. I propose a short remediation plan: contain and encrypt the data, test the two controls, document results, and then re-present closure. I will escalate this internally today because it may be a reportable incident.” I would not frame it as a threat; I would frame it as protecting the client. On payment, I would ask commercial and legal to determine whether a partial invoice or milestone payment is contractually valid for completed work, but not tie it to a false certificate. If the sponsor insists, I would escalate to my firm’s compliance officer and the client’s executive sponsor. The key messages are: no false attestation, immediate data protection, a dated remediation path, and continued partnership. I would also avoid discussing the larger opportunity in the same conversation.
3. What lessons learned and closure documentation should be captured?
Read the worked answer
Closure documentation should record that acceptance was not granted, the open security controls, the data-privacy incident and containment actions, and the remediation plan with owners and dates. Lessons learned should cover: acceptance criteria were not verified before final payment was booked; security testing was not integrated into the schedule; data-handling requirements were not enforced in the test environment; escalation paths for sponsor pressure were unclear; and commercial incentives conflicted with professional judgment. I would also recommend contract changes: make security-control validation a payment milestone, require a data-handling attestation for test environments, and define a conditional-acceptance process. After remediation and retesting, reissue the acceptance certificate with evidence, update the benefits/closure record, and archive the decision log. The reasoning is that closure is not an invoice step; it is the point where the project proves it met its obligations. Capturing this as lessons learned protects future engagements and demonstrates professional accountability.