Solution · Issue & finding management
06

From examiner finding to closed remediation, on one timeline.

Every gap, exam finding, failed test, and self-identified issue lands in one governed queue with its citation, owner, SLA, and the evidence it needs to close.

ForCompliance · Enterprise & operational risk
SurfacesFindings · Tasks & plans · Citations · Evidence
The shape of the problem · 01

What this actually feels like.

  • 01Exam findings live in one spreadsheet, audit findings in another, and self-identified issues in somebody’s inbox.
  • 02A due date slips, and nobody can say who moved it or why.
  • 03An issue is marked closed, and at the next exam there is no evidence the fix happened.
  • 04The board asks for open issues by severity, and building the answer takes a week.
How Zovos handles it · 02

Five steps, one graph.

Every step writes back to the same controls, policies, and issues your team already owns. There is no second source of truth.

  1. 01
    Capture
    Findings open automatically from control drift, monitoring and testing failures, exam requests, and internal-audit engagements. Anyone can self-identify one, and it enters the same queue.
  2. 02
    Route
    Each finding carries its citation from Citations & Authorities. Severity and SLA drive routing and escalation to the owner.
  3. 03
    Plan
    Remediation lives as tasks and action plans under the finding. Each step has an owner and a date, and progress rolls up to the finding’s state.
  4. 04
    Govern
    Changing the severity, owner, or due date takes a reason, and the change lands in an append-only audit trail.
  5. 05
    Close
    Close is blocked without remediation evidence. High, Critical, and examiner findings also need a root cause, an examiner MRA, MRIA, or violation needs a corrective action plan, and closure is maker-checker. An examiner observation closes on the independent sign-off and its rationale alone. The finding then exports audit-ready.
What changes · 03

What the product does instead.

One queue
Exam, audit, testing, drift, and self-identified issues share one governed queue.
Change history
Every change to severity, owner, or due date carries a reason in the audit trail.
Evidence-gated close
No finding closes without remediation evidence attached, except an examiner observation, which closes on an independent sign-off.
Export
One export packages the finding, its citation, and its evidence trail.
Related scenarios · 04

If this is your Friday, these are too.

08

Exam prep and the examiner room

Load the first-day letter, watch it segment into requests, map each one to evidence you already hold, and work every request in the examiner room against its SLA.

Read the scenario→
10

Compliance monitoring & testing

Sample by risk, record results in a sample-by-step matrix, capture exceptions with root cause, and let a governed sign-off promote a failed test straight into a finding.

Read the scenario→

Want to see this on your library?

Bring a control library, a policy, and one regulator paragraph that gives you trouble. We target two-week onboarding.

Talk to the team →All solutions