A finding without an owner never closes; without a closure rationale it reopens three months later. We made both mandatory fields.
Finding lists grow for two reasons: unowned records and closures without a rationale. Both are process problems, supported by the product.
Ownership
Every finding is assigned to a person or team. A finding does not move to "open" before assignment, so no queue forms that nobody watches.
Closure rationale
Closure is tied to one of three reasons:
- Remediated — the asset was removed or the exposure fixed; a verification record is attached.
- Accepted — the risk was knowingly accepted; who accepted it and the review date are recorded.
- Not applicable — the finding is not ours, with a stated reason.
Reopening
When the same finding is detected again it is shown with its previous closure rationale. If a record closed as "not applicable" returns, the rationale itself goes to review.
