Remediation and issue management
You have findings. Close them before the next exam.
Findings from an exam, your sponsor bank, an audit or your own testing, and a deadline to show they are fixed. We turn them into a plan ordered by what each gap is worth, fix them alongside your team, and track every issue until the evidence shows it's closed.
Your problem
A list of findings, a deadline, and no one free to run it
- The findings arrived as a list, with no sense of which ones matter most.
- Your sponsor bank or your examiner wants a plan with owners and dates, and then proof that each item is closed.
- Issues live in a spreadsheet, and closing one means someone saying it's done rather than evidence showing it.
- Your team is already running the program. There's no one spare to run the fix as well.
What you get
Findings closed, and the evidence to prove it
- A remediation plan ordered by what each gap is worth, with owners, dates and dependencies.
- The fixes themselves: policies and procedures rewritten, controls redesigned, and the tooling configured, built with your team rather than handed over.
- Issue tracking to evidenced closure. Each issue moves from open to closed only when the evidence is attached, with deadlines tracked along the way.
- Progress reporting for your compliance committee or board, and the updates your sponsor bank or examiner asks for.
- A readiness review before your independent tester arrives, so you find out what still fails while there's time to fix it.
How we do it
Price, plan, fix, prove
- Every finding is cited to its rule and priced in dollars, so the plan starts with the gaps that carry the most exposure.
- Your forward deployed compliance officer works through the plan with your team and makes the judgment calls.
- Closure is evidenced, not asserted: an issue closes when the records show the control now works.
- The readiness review tests the fixes the same way an independent test would, against the full population, and reports to management.
Starting from scratch rather than fixing? We also design and build compliance programs around the requirements that apply to you: policies, procedures, controls and the tooling behind them.
Independence
We never test what we fixed
Remediation and independent testing are separate services, sold as separate engagements. If we remediate a program, the independent test of that program has to come from someone else: your internal audit function or another qualified firm. Calling the review something other than a test wouldn't change that, and we won't ask your examiner to accept it.
The readiness review is exactly that: a review for your management, before the independent test, so the test itself goes well. It isn't the independent test, and the report says so.
If you only need the independent test, see independent testing.
How the work is done
The audit you already buy, performed by an engine.
- Every record testedControls are tested against the full population of accounts and transactions, not a sample of twenty-five.
- Every requirement citedEach requirement the work runs against is cited to the rule it comes from, with the facts behind it labelled.
- Findings pricedFindings arrive priced in dollars, so remediation is ordered by what each gap is worth.
- A signed reportThe report is signed, and any reader can check that nothing in it changed after signing.
Pricing
Scoped to your findings
This replaces remediation consultants and the spreadsheet you track issues in today. Remediation: Priced at scoping. Program design and build: Priced at scoping. Readiness review: Priced at scoping. Each is set once we've seen the findings. How pricing works
The published method
How this is normally done
The regulator's and the standard-setter's own method for this work, explained in plain English and cited to the source. We have nothing to hide about how we do it: check our process against it.
- ReferenceCompliance Remediation and Issue Management: From Finding to Validated ClosureHow findings, MRAs and MRIAs are managed to closure: root cause, corrective action plans with owners and deadlines, independent validation, and the separation of remediation from testing.
- Consulting PracticeHow to Write a Corrective Action Plan After an Audit FindingThe field-by-field format for a corrective action plan after an audit or exam finding, a worked example, when to escalate to a team CAPA, and what makes examiners reject a CAP.
- Field GuideAML Program Gap Analysis: A Practitioner's GuideWhat it is, when you need one, the benchmarks to measure against, a step-by-step method, how to score gaps, and how to turn findings into a remediation plan that closes.
What happens next
Three steps from here.
- 01
Send us the findings
The letter, the report or the list, and the deadline you are working to. We tell you plainly whether we can help.
- 02
A written scope
What we will fix, what you will receive, the timeline and the price, in writing before you commit.
- 03
Fix, track, prove
We work the plan with your team, track every issue to evidenced closure, and review the fixes before the independent test.
Book a scoping call
Practitioner-led. Scope and price are set on the call.