An action marked complete does not prove that risk has reduced. Closure requires evidence that the required outcome exists, the control operates and the residual exposure is understood.
Key judgement
The person who owns the corrective action should not be the sole judge of its closure. Material findings require verification on the client’s behalf.
Why conventional closure fails
Programme action logs usually track activity: a document was updated, a meeting was held, a plan was produced or an owner confirmed completion. Those records may prove that work happened. They do not prove that the original finding has been resolved.
Weak closure creates false confidence. Findings disappear from reporting while the underlying control remains ineffective, the evidence covers only part of the population or the risk has merely moved elsewhere.
Five closure tests
| Test | Question |
|---|---|
| Action completion | Was the agreed corrective action completed in full and within the required scope? |
| Control operation | Is the corrected control operating in practice, not merely designed or documented? |
| Evidence verification | Is there current, traceable evidence that another competent reviewer can examine? |
| Risk reduction | Has the original consequence or likelihood reduced to the intended level? |
| Residual acceptance | Has the accountable client explicitly accepted any exposure that remains? |
Closure workflow
1. Restate the finding
2. Receive the evidence
3. Test the outcome
4. Assess residual risk
5. Record the closure
Permitted closure outcomes
| Outcome | Meaning | Reporting treatment |
|---|---|---|
| Closed | All required outcomes are evidenced, the control operates and residual exposure is accepted. | Record the verifier, evidence, date and residual risk. |
| Partially Closed | Some outcomes are evidenced, but a material element remains open. | Keep the finding visible and define the remaining condition. |
| Not Closed | Evidence is absent, insufficient or shows that the intended result has not been achieved. | Retain or escalate the finding. Do not reset the history. |
| Superseded by decision | The client has made a new explicit decision that changes the original requirement or accepts the exposure. | Link the decision record and named risk owner. Do not describe it as remediation. |
Evidence appropriate to closure
| Finding area | Examples of stronger closure evidence | Insufficient on its own |
|---|---|---|
| Plan and dependency | Updated logic, confirmed owner, achievable dates and observed progress against the revised control. | An updated slide or verbal commitment. |
| Testing and defects | Executed tests, traceable coverage, defect disposition and evidence that the failed condition no longer occurs. | A statement that retesting is complete. |
| Migration | Reconciliation results, resolved exceptions, repeatable rules and accountable acceptance. | Matching row totals. |
| Cutover | Timed rehearsal evidence, resolved failures, decision triggers and demonstrated contingency. | A completed runbook review. |
| Operations | Observed support process, monitoring evidence, service scenarios and operational owner acceptance. | A handover meeting or training attendance list. |
| Governance | Decision record, operating cadence, escalations used and accountable ownership. | New terms of reference that have not operated. |
Independence in closure
The delivery supplier owns remediation and provides evidence. The client owns the decision to accept residual risk. Enigma can verify closure where it did not own the delivery action. If an Enigma practitioner directly supported implementation of the control, a separate reviewer must verify it or the limitation must be declared.
Repeat findings
A finding that repeatedly reopens usually indicates that the action treated a symptom rather than the control failure. The classification and cause should be reassessed. Repeated administrative closure can itself become a governance finding because it misstates the client’s exposure.
Closure record
- Original finding and classification.
- Agreed outcome and decision condition.
- Evidence examined, source, owner and date.
- Verification work performed and limitations.
- Closure outcome and rationale.
- Residual risk, accountable owner and acceptance decision.
- Any monitoring requirement or trigger for reassessment.
Closure rule
Close the exposure, not the action. Where the evidence proves activity but not control effectiveness, the finding remains open.
How this standard supports client governance
This standard gives the client a repeatable basis for challenging delivery claims without taking ownership away from the supplier. It enables proportionate scrutiny, records the reasoning behind material decisions and makes residual uncertainty visible to the accountable decision maker.
Use with
Independence safeguard
No practitioner may independently assure delivery that they directly own. Where advisory support and assurance are both required, roles, reporting lines and review responsibility must be separated and recorded.