Purpose
Ensure findings and material control failures receive clear reporting, accountable remediation and independent closure verification.
Steps
- Record each finding with source, affected requirement and control, severity, cause, impact and evidence.
- Distinguish reporting categories per the manual’s section 4.5 where relevant: internal management escalation, operational restrictive measures, external UTR reporting status, and CBCS notification or reporting status.
- Obtain a management response, accountable owner, target date and interim risk treatment.
- Escalate material control failures, sanctions true matches, unresolved material sanctions issues, UTR-reportable cases, and significant AML/CFT/CPF control weaknesses through the appropriate governance channels immediately.
- Report open, overdue, repeat and high-risk findings to management and the Board forum. Findings are consolidated into a single quarterly report to the Board, supported by corrective action tracking within existing compliance registers.
- Challenge unsupported extensions or risk acceptance.
- Obtain remediation evidence and perform follow-up testing independent of the action owner.
- Close only when the cause is addressed and control operation is demonstrated.
- Update risk assessments, policies, controls, training and monitoring where systemic change is required.
Exceptions and Escalation
Administrative closure, management assertion or completion of an action without effectiveness evidence is insufficient for closure.
Records
- Finding and severity assessment
- Management response and action plan
- Escalation and regulatory status
- Overdue and trend reporting
- Follow-up testing and closure approval
Relationships
- Policy: POL-ICA-001 Internal Controls and Audit Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-ICA-006 Ensure Findings Are Escalated and Remediated
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: continuous with quarterly reporting
History
- 2026-07-26: Created from section 4.5 of the approved ICA Manual.