Compliance audit findings and retests

Who does what

A compliance auditor has read-only access to the workspace plus the audit records. The auditor raises findings and retests them. The agency's owner, or a team member given audit access, records management's response and fixes the problem. Retests and closing a finding are for the lead auditor named on the audit.

Raising a finding

The auditor records a finding as a draft first: what was found, the control it relates to, and the home or certificate it is about. Each finding has a severity: critical, high, medium, low or observation. Before a finding can be raised, it needs the root cause, the impact and a recommendation.

Responding and fixing

Once a finding is raised, the agency records management's response: what went wrong and what it will do. Agree a fix date and who will do the work. A finding cannot move to remediation or retest until a response is recorded. Tendmere records who wrote the response and when.

Retests

When the fix is done, the finding moves to retest. The lead auditor checks the fix independently and records the retest result. A finding can only be closed after a retest is recorded. If the fix did not hold, the finding is reopened and goes back to remediation; the Retests page counts it as a failed retest.

The stages

Draft → Raised → Management response → Remediation → Retest → Closed. Findings move one stage at a time.

Signing off

The lead auditor can sign the audit only when every control test is done and every finding and evidence request is closed or accepted. A signed audit is read-only. Record follow-up work in a new audit.

Where to find it

Open the audit workspace and choose Findings for every finding with its response and fix date, or Retests for findings ready to test again.