While preparing a post-incident review, the security manager finds that most corrective actions agreed after the previous two incidents were never completed. What is the BEST way to address this?
Select an answer to reveal the explanation.
Short Explanation
A to-do list nobody owns is just a wish list. You need every action to have a name, a date and someone checking that it got done. The trap is re-doing the review or quietly dropping the old items as if the risk went away.
Full Explanation
Corrective actions from post-incident reviews reduce the likelihood or impact of recurrence only when they are implemented. Lack of completion is typically a governance problem: no clear owner, no deadline, no tracking and no visibility to management. Assigning an accountable owner and due date to each action, recording it in a tracked register, verifying completion and reporting status and overdue items to management closes the loop and ensures resources are allocated or risks formally accepted where actions cannot proceed. Repeating previous reviews to re-agree the same actions consumes effort without changing the conditions that prevented completion, so the actions will likely stall again. Removing uncompleted actions because they are old assumes the underlying risk has gone away; unless it has been reassessed, the weakness may still exist, and deleting the actions hides it from management. Letting each team implement whatever it considers useful without oversight removes the prioritization and assurance that tracking provides, and agreed actions may again be ignored. Exam caveat: where an action is deliberately not implemented, the residual risk should be accepted by the appropriate risk owner and documented. Operational check: confirm the corrective action register shows owners, dates and verified closure, and that overdue items are escalated.