Identified issues, risks, and recommended remediations are included when determining compliance.
Identified issues, risks, and recommended remediations are included when determining compliance.
Identified issues, risks, and recommended remediations are indeed included when determining compliance. This is because compliance determinations need to document not only whether requirements have been met but also to identify any deficiencies, associated risks, and provide recommendations for addressing those deficiencies.
pg57, Audits and assessments are mechanisms to document compliance with internal or external requirements (or identify deficiencies). Reporting needs to include a compliance determination, as well as a list of identified issues, risks, and remediation recommendations.
Audits and assessments are mechanisms to document compliance with internal or external requirements (or identify deficiencies). Reporting needs to include a compliance determination, as well as a list of identified issues, risks, and remediation recommendations.