A finding is something your auditor found wrong. You answer it once, with your position, and plan the fix. Your answer travels into the opinion.
Who can do this
An owner, editor or contributor can answer a finding and set the fix. Only an owner or editor can accept the risk.
Find your findings
Open Audit findings under Risk & audit on the rail. The page is headed What your auditor found. The tabs are Still open, Waiting on you, You disagreed, Settled and Everything.
Each finding has a severity: critical, high, medium or low. A finding carried over from an earlier audit says where it was carried from.
Answer a finding
Open the finding.
- Press Accept the finding or Disagree, with a reason.
- Write your reasoning. It is optional when you accept. A disagreement with no reason is refused.
- Press Record this response.
Both answers are recorded and both travel into the opinion. Disagreeing does not remove the finding. It puts your reasoning beside it. A response is written once.
Plan the fix
Under The fix, set who owns it and when it is due, then press Save. The plan is yours, not the auditor's. An auditor who writes the remediation plan is no longer independent of it.
Accept the risk
If you decide not to fix it, press Accept the risk instead of fixing it, then Yes, accept the risk. This is on the record and shown to the next auditor.
When you cannot answer
Once the audit's opinion is signed, the file is frozen and the fix can no longer be changed there. If management will not reply, the auditor can record that no response was received. That is disclosed.
Common questions
"Does a critical finding matter more?" Yes. While a critical finding is open, the auditor cannot give a clean opinion.
"Can we change our response?" No. A response is written once.
"Can the auditor see our reasoning?" Yes. It sits beside the finding and goes into the opinion.