Auditors note weak privilege reviews on a benefits system, then confirm the gap is real. How should the engagement progress that item?
Select an answer to reveal the explanation.
Short Explanation
An observation is a sticky note; a finding is the work order with an owner. When the privilege-review gap checks out, elevate it so remediation has a name on it. Hiding or dissolving it into a quiet incident loses the audit trail.
Full Explanation
Audit lifecycles typically move from observations (potential issues noted in fieldwork) to confirmed findings that require remediation ownership and tracking. Elevating confirmed issues to findings with owners is the correct progression. Deleting observations, retiring entities to hide gaps, or absorbing everything into a resolved incident without a finding undermines engagement integrity.