A finding names a gap. It does not close one. The remediation plan records, for each finding, which quarter it closes by, who at the client owns it and what will actually be done. The commitments travel with the opinion.
Who can do this
The DPCO firm working on the audit records the plan in the client's workspace. The commitments are the client's: every owner must be one of the client's own people. The client can read the plan. The drafting controls are not shown to them.
Open the plan
Open the audit and press Actions & remediation. The page is headed What they have committed to close, and by when. To go back, press Back to the audit.
The plan across the year shows the four quarters of the year after the audited period ends, plus one lane for later. If the audit's period names no year, there are no quarters to commit to, and the page says so.
Record a commitment
Each finding has its own card, with its severity and where it stands.
- Under Closes by, choose the quarter. Not committed clears it.
- Under Owned there by, choose the person at the client who owns it. Nobody named yet clears it.
- Under What they will actually do, write the actual step, not "we will fix it". Press Save the action.
An action counts only once it is more than 20 characters long.
Where each commitment stands
The page reads three states from the card itself:
- No commitment yet: no quarter, or no owner.
- Dated, not described: a quarter and an owner, but no action.
- Committed: a quarter, an owner and an action.
Four more are stated by hand, under Where it stands: Under way, Met, Missed and Risk accepted. A stated one wins over the card. Choose Read from the row to go back to the reading from the card.
Where the plan stands counts the findings in each state.
Severity and the quarter
A critical finding should close in the first quarter, a high one by the second and a medium one by the third. A low finding can go anywhere. A later date shows a warning beside the card. This is Asiri's own reading of a plan, not a rule in the Act, which sets no remediation deadline.
Send the plan
When every finding is committed, or stated by hand, press Send for their agreement. Until then the button says what is missing, such as how many findings need an owner, a date or an action.
After sending, the page shows What happens now.
Carried findings
Carried from a previous audit lists findings raised on an earlier audit and still open. A missed commitment weighs more than the finding it came from.
When the opinion is signed
Signing freezes the audit file. The plan can no longer be changed or sent. The signed opinion states what was on the record when it was formed.
Common questions
"Can the firm own a fix?" No. A gap owned by the firm auditing it is owned by nobody. Name somebody with a seat in the client's workspace.
"Is a missed commitment worse than the finding?" Yes. It was promised in writing. The next audit opens with it.
"Can the client accept the risk instead?" Yes. Accepting a risk is a board decision. Asiri records who accepted it and when, and it appears in the opinion and to the next auditor.