Part IV · Chapter 7 · The Audit · lesson 9
Write the response to a finding about your own register
14 min
Builds on An exception is a sentence in a report, not a verdict
Part IV · Chapter 7 · The Audit · lesson 9
14 min
Builds on An exception is a sentence in a report, not a verdict
Here is a finding, as it would be written: for one of four quarters examined, no evidence of the access review being performed was available.
And here is the response most organisations send back on the first attempt:
Management has implemented additional controls and will continue to monitor this area.
That response is read far more often than the finding it answers — by the next buyer, by next year's reviewer, by whoever inherits the register — and it tells every one of them nothing. The finding is specific and the answer is weather.
Four sentences, in this order.
What happened. The instance, the control, the months. Specific enough that somebody could check it.
Why. The actual cause, not the category. The named reviewer was on leave in March and no backup performer was documented rather than a process gap.
What you have changed. The change to the design, in the present tense, because it is already true.
When it takes effect. A date. This is the sentence that gets checked later, and the only one with a cost attached.
Nothing else belongs in it. No reassurance, no restatement of how seriously you take security, no argument that the gap did not matter — the previous lessons covered why the moment a response starts arguing it stops being a response.
Written out, the whole thing is shorter than the version that says nothing:
The Q1 review did not take place. The reviewer named in the description was on leave in March and no backup performer was documented. Since 12 April the control names a primary and a backup reviewer, and each review is created as a ticket from a recurring template rather than held in a meeting. The first instance under the new design ran on 18 April.
Four facts, three of them checkable by somebody else, and one date that is a commitment.
This is the part that separates a response from a promise. If the fourth sentence is real, something in your own register has moved: a second name against the control, a justification written where there was none, a date, a cadence that now matches what you actually do.
So write this one into the register rather than into an email. Pick one thing the referee is currently complaining about, and respond to it by changing the thing — then read what the referee says afterwards, which is the only feedback available and the only kind that is honest.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
One or two sentences, in your own words. The test is whether you would read it out to a customer.
Six facts about you
These decide which controls are even yours to argue about. The honest answer usually removes more than it adds.
The period you are claiming
Everything in here is measured against these two dates. Typed as year-month-day, so the same thing is stored whatever your browser thinks the date format is.
two dates, the second after the first
What could go wrong
A sentence with a victim in it, not a category. There is no score field here and there is nowhere to put one: the two bands are never multiplied.
Once a year or so
A customer notices
What will you do about it?
What you could hand over
Only what already exists, with a date on it. A policy is real evidence of design and no evidence at all of operation, which is why that is the second question.
What does it show?
Four of its rules are, read the right way, findings with a management response already implied.
A control excluded with no justification is the first question from lesson four — who approved this, and why — with nobody named. The response is the sentence you would say out loud about why it does not apply to you.
A control in place with nobody owning it is the fifth walkthrough question unanswered. The response is a name, and then telling that person.
A risk accepted with nobody named as accepting it is the single most common real finding in this field. The response is a name, and the uncomfortable exercise of imagining showing them the row.
A control last reviewed before the risk it addresses last moved is a control that was checked against a different problem. The response is either a review dated after the change, or a sentence saying why the change did not affect it.
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
Effective from next quarter, the review is performed monthly. That is twelve instances a year instead of four, each costing some hours and some number of people, forever, and it was agreed in a room by people who were optimising for the room.
This is the most common way a good response goes wrong. Nobody lies, nobody over-promises in bad faith; somebody commits to a cadence under mild pressure without multiplying it by anything. Lesson seven in this track is the multiplication, and it takes about four minutes.
The honest alternative is usually available and rarely offered: keep the cadence and change the thing that caused the miss. A named backup performer costs nothing per year. Tripling the cadence costs eight extra instances a year and does not address a cause that was about cover rather than frequency.
Check