From finding to action plan
Gaps arise in many places: in the assessment, when a control is answered with “none”, in the internal audit, in the management review, through a finding in the Security Score or through a customer request. What matters is that each of these gaps ends up in one place and is no longer lost there.
An action plan does not need much. A title and a responsible person are mandatory. Phrase the title so that it makes sense without context, for example “Introduce multi-factor authentication for remote access” rather than “MFA”. In the description, record exactly what needs to be done and how you can tell it is done.
Then link the plan to everything that belongs to it: the control from the framework, the affected document, the vulnerability or the request. You select controls directly from the active framework. That way, anyone who opens the control can see that the gap is being worked on.
Set a deadline, even though it is optional. Experience shows that a plan without a date gets left behind. Choose the deadline realistically and according to risk: a critical vulnerability takes priority over the wording of a policy.
Good practice for ownership and deadlines
Every plan has exactly one responsible person. This is deliberate. Several owners lead to nobody feeling responsible. The responsible person does not have to carry out the measure alone, but they make sure it gets done and report on progress.
Split large undertakings into several plans. “Introduce an ISMS” is not an action plan but a project. “Review access rights for the accounting system” is one. Small, clearly defined plans can be tracked and completed. That shows progress and keeps everyone involved on track.
Go through the open plans regularly, for example in a monthly meeting with the owners. Ask not only about status but about obstacles. If a deadline slips, adjust it and record the reason in the description. A traceably postponed date is not a problem in the audit; one that is silently missed is.
Only complete a plan once the measure is effective, and link the proof of this as evidence.
What auditors check for corrective action
Management system standards such as ISO 27001 and ISO 9001 require you to react to nonconformities, determine the cause, take action and evaluate its effectiveness. The auditor checks this cycle using examples.
They pick a finding from the last external or internal audit and ask what became of it. Good answers show a plan with a responsible person, a deadline, a history and proof of implementation. Weak answers consist of the sentence that it was discussed.
Auditors pay particular attention to root cause analysis. Was only the symptom fixed, or was the problem prevented from recurring? Note briefly in the plan's description what the cause was and why the measure addresses it.
The activity log is also revealing for the auditor. It shows when a plan was created, changed and completed, and by whom. With the “External auditor” role they can see this themselves and add comments, but never delete anything. The log also records that the access comes from an external person.
Common mistakes
The most common mistake is the plan that stays open forever. It was created months ago, nobody feels responsible, and the deadline passed long ago. Such plans do more harm than good, because they show that gaps are known but not being addressed. Clean up regularly: implement, reschedule or close with a reason.
A second mistake is completing without proof. The status “completed” alone convinces no auditor. Link the evidence that the measure has been implemented, such as an amended policy, a screenshot of the new setting or the record of a training session.
Third, the link to the control is often missing. A plan that only sits in a list does not explain which requirement it fulfils. With the link to the control, the connection is still clear months later.
Fourth, technical findings and organisational gaps are managed separately. In Sightadel both come together in the same action plans. That way management sees in one place what is open.
