A control test fails for the ERP privileged-access control. What should happen next in the lifecycle?
Select an answer to reveal the explanation.
Short Explanation
A failed test isn’t a diary entry—it becomes a tracked issue with remediation work. Fix the gap, then prove it. Sweeping the fail under the rug keeps the dashboard pretty and the risk real.
Full Explanation
Failed control tests should continue into the issue and remediation lifecycle so findings are owned, tracked, and closed. Marking the control effective without remediation, deleting evidence, or leaving private notes does not satisfy IRM compliance process expectations. The chain is test → issue → remediation (and typically retest).