Failed controls produced many open issues; some may miss dates and need formal risk acceptance. How should the backlog be managed?
Select an answer to reveal the explanation.
Short Explanation
A backlog without dates is a junk drawer. Track due dates, and if a fix will slip, park it with real risk acceptance—not delete-to-green or mass close theater. Forever exceptions for everything are not management either.
Full Explanation
Issue backlog management assigns accountability, due dates, and escalation or risk acceptance when remediation cannot meet the original timeline. Managing open issues from failed controls this way preserves visibility and governance. Deleting overdue items, bulk-closing without remediation, or converting all issues into permanent exceptions undermine compliance supporting processes.