Remediation tasks for a failed control are marked complete. What additional lifecycle step restores confidence that the control is effective?
Select an answer to reveal the explanation.
Short Explanation
Closing the ticket isn’t the same as proving the fix. Retest after remediation—show the control works now. Otherwise “effective” is just a hopeful status flip.
Full Explanation
Issue and remediation closure alone do not re-establish control effectiveness. After remediation tasks for a failed control are marked complete, the Policy and Compliance lifecycle expects verification—typically a retest or comparable evidence—before treating the control as effective again. Automatically setting the control to effective when any task closes, with no evidence of retest, greenwashes municipal posture and will fail sampling. Deleting the original failed test so historical findings vanish destroys examiner-valuable history and prior-period answers. Closing the issue without linking back to the control breaks lineage between finding, fix, and verification that civic auditors expect to walk. Exam caveat: equivalent verification may be risk-based for some controls, but some form of post-remediation validation must be defensible—silence is not a method. Operational check: after remediation completes, schedule and perform a retest against the same control, attach evidence, update status only after pass, and show the fail-remediate-retest chain in reporting used by city compliance leads. Train owners that task closure is necessary but not sufficient, sample closures monthly for missing retests, and escalate repeat offenders to bureau management.