This requirement exists to ensure verification that agreed corrective actions have been implemented and are effective is consistently governed, documented, and capable of producing reliable assurance. Without it, audit activities may be inconsistent, difficult to evidence, or insufficient to support management, regulatory, and stakeholder decisions.
Document the required verification that agreed corrective actions have been implemented and are effective; assign accountable roles and approval points; define minimum records and evidence; apply the approved audit methodology and risk criteria; and retain evidence of execution and review. Periodically review the process for changes in organizational risk, regulatory expectations, and audit scope.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 10.2 – Nonconformity and corrective action |
ISO
Standard
|
v2022 | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.16-3.6.2 – Internal IS assessment by IS |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §13 – Cyber security preparedness indicators; 16) Maintenance, Monitoring, and Analysis of Audit Logs – 16.2 Systematic audit-log management and analysis for detection, understanding and recovery |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.4 Cyber Audit |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 6(6) – Regular internal audit of ICT risk management framework Article 6(7) – Formal follow-up and timely remediation of critical ICT audit findings |
EU
Regulation
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA04 – Managed Assurance > MEA04.09 – Follow up on recommendations and actions. 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.02 – Review effectiveness of business process controls. |
COBIT
Governance Framework
|
v2019 | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 9.2.1 – General; 9.2.2 – Audit programme(s) |
ISO
Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight | GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed GV.OV – Oversight | GV.OV-02 – The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; CA-7 – CONTINUOUS MONITORING |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Review – Timely Closure of Audit Findings |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC3.2 – Risk Assessment – COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |