Findings need an owner and a date, or they are just observations

Every audit produces findings. Most organisations put them in a spreadsheet with a severity and a status. Twelve months later the same findings appear in the next audit, still open, and someone has to explain why.

Status is not progress

“Open” tells you nothing. Open because nobody has looked at it, open because it is being fixed this sprint, and open because it was consciously accepted are three completely different situations that a single status column collapses into one.

findings
  id, source            -- internal | external | self_identified
  description, severity
  owner                 -- a person, never a team
  due_on
  state                 -- triage | accepted_risk | in_progress
                        -- | remediated | verified
  remediation_ref       -- the ticket doing the work
  verified_by, verified_at
  accepted_by, accepted_until   -- if risk accepted

The two states people leave out are the important ones. Accepted risk with a named accepter and an expiry is a legitimate outcome — some things genuinely are not worth fixing, and recording that is better than leaving them open forever. Verified is separate from remediated, because “the engineer says it is fixed” and “someone checked” are different claims.

A team is not an owner

Assigning a finding to “Platform” means it is assigned to nobody. Named person, always. They can delegate; the accountability does not move.

Due dates driven by severity

Severity should imply a target date automatically — critical in days, high in weeks, medium by the next review. Otherwise everything gets the same distant date and severity stops meaning anything.

Overdue findings escalate on a schedule rather than being noticed at the next audit.

Verification closes the loop

The step almost always missing. Remediated means the work was done. Verified means someone independent confirmed it, ideally by re-running the check that produced the finding.

If the original detection was a query, verification is running the query again and storing the result as evidence. That makes closure demonstrable rather than asserted, and it is what stops the same finding reappearing next year.

The number worth watching

Not open findings. Time from raised to verified, split by severity. That single measure tells you whether remediation is a process or a queue that grows.