A control test fails for the ERP privileged-access control. What should happen next in the lifecycle?
Select an answer to reveal the explanation.
Short Explanation
A failed test isn’t a diary entry—it becomes a tracked issue with remediation work. Fix the gap, then prove it. Sweeping the fail under the rug keeps the dashboard pretty and the risk real.
Full Explanation
Failed control tests should continue into the issue and remediation lifecycle so findings are owned, tracked, and closed with evidence. When a control test fails for the ERP privileged-access control, open a tracked issue with remediation tasks, then drive corrective action to closure. Leaving the failure as a private note with no tracked remediation hides risk from municipal leadership and prevents portfolio reporting. Marking the control effective immediately without addressing the finding falsifies posture and will not survive examiner sampling. Deleting the failed test so dashboards stay green is an integrity failure that destroys prior-period evidence. Exam caveat: opening an issue does not by itself restore effectiveness—retest or equivalent verification is still required after remediation before treating the control as effective again. Operational check: fail a pilot test in subprod, confirm issue creation and assignment, walk remediation tasks to completion, perform retest, verify the control's status reflects verified recovery, and document the fail-to-issue path in the city's compliance SOP used by ERP and other bureau owners. Include this path in onboarding so new analysts never greenwash failures.