{"description":"Runs on the existing control item. Verify remediation readiness, independently retest the changed control, evaluate sustained results, and approve a supported closure decision. Deliver the reviewed result and open actions to the responsible register owner and the named companion procedure.","edges":[{"id":"e-retest-plan-retest-closure","source":"retest-plan","target":"retest-closure"}],"isPublic":true,"itemTypeSlug":"control","metadata":{"capabilities":["control-remediation-retest-closure"],"controlVerbs":{"UC-AUDIT-17":"tests","UC-AUDIT-21":"tests"},"controls":["UC-AUDIT-17","UC-AUDIT-21"],"department":"internal-audit","domains":["audit"],"kind":"control-remediation-retest-closure","library":{"aliases":[{"source":"studio-seed","sourceTemplateId":"coworkcanvas:template:control-remediation-retest-closure"}],"canonicalUrl":"https://workflow-library.com/all/?w=audit-control-remediation-retest-closure","contentDigest":"sha256:6748ff523340814f9924c86d601621610bb452a0adc63aa26212687870a3208d","prerequisites":{"anchorItemType":{"slug":"control"},"evidenceDestinations":[{"description":"Restricted native step results, attached documents, durable item fields and native approvals.","id":"review-evidence"}],"handoffs":[{"direction":"output","name":"Reviewed register result and open actions","sourceTemplateId":"workflow-library:controls-remediation-delivery"}],"roles":[{"contribution":"expertise","description":"Test supervisor independent of the operator. Confirm readiness and approve the independent retest plan.","id":"reviewer-1","nodeIds":["retest-plan"]},{"contribution":"approval","description":"Independent audit reviewer. Approve remediation closure.","id":"reviewer-2","nodeIds":["retest-closure"]}],"status":"declared"},"provenance":[{"source":"brain/scripts/studio-seed","sourceTemplateId":"coworkcanvas:template:control-remediation-retest-closure"}],"releaseId":"sha256:6748ff523340814f9924c86d601621610bb452a0adc63aa26212687870a3208d","schemaVersion":1,"sourceTemplateId":"workflow-library:audit-control-remediation-retest-closure"},"lineOfDefense":"assure","mappingStatus":"mapped","risks":[],"slug":"audit-control-remediation-retest-closure","source":"coworkcanvas-gallery","standards":["coso-ic","iia-2024","nist-800-53","sox"],"teams":["internal-audit"]},"name":"Control Remediation Retest & Closure","nodes":[{"data":{"controls":[],"instructions":"**Objective**\nConfirm readiness and approve the independent retest plan. The reviewer decides from the complete package described below.\n\n**Inputs**\n1. Use the approved remediation plan and its completion evidence, change tickets, updated control description, owner certification and expected post-change occurrences, with the original exception, impact evaluation, updated attributes and independence requirements.\n\n**Procedure**\n1. Inspect implementation evidence rather than accepting status, compare delivered actions to the plan, verify effective dates and scope, and quantify occurrences since implementation. Then set the period, population, sample or full-inspection method, attributes, evidence expectations, recurrence criteria, tester independence and treatment of transitional items.\n\n**Record in AssureSwarm**\n1. Document each action with its evidence reference and implementation date, deviations from plan, the available population and the readiness decision, then the approved scope, tester, population source, sample basis, attributes, change-specific procedures, success criteria and exclusions. Also record readiness result; retest period; retest method.\n\n**Exit criteria**\nTest supervisor independent of the operator provides expertise: The remediation is demonstrably implemented or returned with precise gaps, enough post-change activity exists for the chosen method, the plan directly tests the remediated cause, independence is documented, and success criteria are set before execution.","kind":"task","label":"Confirm readiness and approve the independent retest plan","requiredApprovals":1},"id":"retest-plan"},{"data":{"controls":["UC-AUDIT-17","UC-AUDIT-21"],"instructions":"**Objective**\nApprove remediation closure. The reviewer decides from the complete package described below.\n\n**Inputs**\n1. Use the frozen post-change population, approved selection, updated control criteria, implementation evidence, source records, system logs, approvals, and original failure pattern.\n2. Review the approved plan, item-level results, new exceptions, original root cause, implementation timeline, monitoring evidence, control frequency, and owner accountability.\n3. Use all remediation milestones, retest work, exception results, evaluation, monitoring commitments, Issue status, owner response, and required governance approvals.\n\n**Procedure**\n1. Test each item consistently, retain evidence for all attributes, compare results to the original condition, investigate anomalies and unavailable support, and keep management explanations separate from tester results.\n2. Reconcile counts, assess any recurrence or new failure mode, consider whether the observation period is representative, verify sustainable ownership and monitoring, and decide whether added work is necessary.\n3. Confirm closure criteria are met, link the exact evidence supporting each criterion, verify related records are consistent, and return or reopen the matter when limitations or recurrence prevent closure.\n\nAdditional canonical requirements reviewed with this package:\nVerify Remediation Implementation: Verify the approved corrective action is implemented as designed, including configuration, procedure, owner, and retained implementation evidence.\nSelect Post-Remediation Sample: Define the post-remediation population and select a sample that covers the corrected control operation and relevant risk scenarios.\nReperform Failed Attributes: Independently reperform the attributes that failed, comparing evidence and timing to the corrected design rather than relying on management assertion.\nAssess Recurrence Risk: Assess whether the root cause can recur, whether related controls require testing, and whether compensating controls remain necessary.\nIndependently Approve Closure: Record the independent closure conclusion, residual risk, linked evidence, and any follow-up monitoring required after closure.\n\n**Record in AssureSwarm**\n1. Complete the item-level matrix, evidence links, tester identity, dates, exception details, recurrence analysis, count reconciliation, and any deviations from the approved plan. Also record items tested; exceptions found.\n2. Document the evaluation, result pattern, sustainability factors, limitations, monitoring commitments, reopened actions, and the rationale for closure consideration or continued remediation. Also record retest evaluation.\n3. Record the decision, rationale, approvers, closure or continuation date, remaining monitoring, linked Issue and remediation updates, and any residual action owner.\n\n**Exit criteria**\nIndependent audit reviewer provides approval: All planned items and attributes have supported results, deviations are approved or resolved, observed exceptions are reproducible, and the work is ready for independent evaluation. The evaluation follows the preapproved criteria, contrary evidence is addressed, remaining risk is explicit, and only supported cases advance to final closure approval. The authorized reviewer accepts a decision supported by the full record, linked statuses can be updated consistently, and workflow completion is not used as a substitute for the explicit closure decision.","kind":"task","label":"Approve remediation closure","requiredApprovals":1},"id":"retest-closure"}],"sourceTemplateId":"workflow-library:audit-control-remediation-retest-closure"}