Portfolio evidence / 3 MIN READ
A remediation ticket is complete. Is the finding ready to close?
Use a fictional closure worksheet to separate corrective work, verification, remaining gaps and decision authority in a GRC portfolio.
On this page
Treat the ticket's completion status as one piece of evidence. Compare the completed work with the finding's actual scope and agreed closure criteria, then state what was verified and what remains unknown. The person who performs the corrective action may not be the person authorized to close the finding.
An original closure packet
Fictional Cedar Vale's finding F-08 identifies three ownerless service accounts and no documented process for reviewing ownership changes. The agreed actions are to assign owners to those accounts and establish a recurring review with a retained record. The exercise does not prescribe a universal review frequency or regulatory requirement.
The packet contains a completed ticket, a spreadsheet naming three owners and a draft review procedure. It contains no record of the recurring review operating.
| Closure question | Supplied evidence | Bounded conclusion |
|---|---|---|
| Were owners named for the three listed accounts? | Spreadsheet with three entries | Named ownership is documented for those entries |
| Does the list cover the finding's population? | No reconciliation supplied | Coverage remains unverified |
| Was the recurring review established and performed? | Draft procedure only | Planned process is visible; operation is not demonstrated |
| Who may approve closure? | Not specified in the packet | Request the decision owner; do not assume authority |
Write a recommendation that survives a new fact
First version: “Do not recommend full closure on the supplied packet. Request a reconciliation to the affected account population, the approved review process and evidence of its operation under the agreed criteria. The named-owner action is documented, while the broader process action remains open.”
Now add one fact: a signed reconciliation confirms that the three listed accounts are the complete population for F-08. Revise only the population conclusion. That new record does not make the draft procedure approved or prove that a review occurred.
This update is the important part of the exercise. A conclusion should change with the evidence that bears on it, rather than jumping from “incomplete” to “everything is effective.”
Keep the trail usable
Record the finding reference, criterion, action owner, evidence reference, verification performed, result, remaining limitation and decision recipient. Do not use a completion percentage without explaining what its denominator represents. Two completed tasks out of three do not necessarily mean two-thirds of the risk has disappeared.
The NIST OSCAL POA&M model provides an example of structured remediation planning and status information. This worksheet is a small teaching exercise, not an OSCAL implementation or a substitute for an organization's assessment process.
Use it in a portfolio honestly
Present the initial packet, your first conclusion, the added record and your revision. Label all inputs fictional and identify your own analysis. Never describe this as closing a real client finding.
If you want practice connecting this kind of decision to a broader artifact set, compare the remediation-closure preparation path with the actual Portfolio Kit sample. For the underlying explanation structure, read how to explain a control test. The free exercise should remain useful even if you never buy a book.
PUT IT INTO PRACTICE
Risk & Evidence Portfolio Kit
Connect the individual document to a complete fictional case, with registers and a versioned decision memo.