Remediation

01After the decision, make the gap disappear #sec_4d44cfc6

An access review does not only produce verdicts. When a right, a configuration or a resource property is not compliant, this finding must become an action followed up to its result. Remediation is the link between what has been decided and what has actually changed.

REVIEWIT deliberately separates the verdict from the obligation. The verdict expresses the reviewer's judgment. The remediation obligation is derived from the applicable policy: it indicates the gap to be corrected, its owner, its deadline and the planned channel. This separation preserves the integrity of the decision while allowing the correction strategy to evolve in a versioned manner.

Each out-of-compliance criterion creates its own obligation. An overall 'partially compliant' result thus remains actionable: the causes that compose it are neither flattened nor lost.

02A durable obligation, not a disposable ticket #sec_45f75eb7

A new campaign does not reset the age of the risk. If an open obligation already exists for the same resource and the same criterion, the new decision is attached to it. Its age clock continues from the first finding.

This persistence allows to distinguish :

• obligations born during the current cycle;
• those inherited from a previous campaign;
• recurrent or chronic gaps, which the repetition of reviews must not mask.

The obligation goes through several states: it can be deferred by a temporary exception, ready to be dispatched, sent, in verification, closed, declared out of scope or become irrelevant after a new collection. When no action is technically feasible, it remains visible in a non-executable state and an internal task materializes the impossibility. A connector failure never makes the risk disappear.

The service deadline starts when the obligation actually becomes dispatchable. REVIEWIT separately measures the actual age of the finding and the processing time attributable to the owner.

03Three channels, one responsibility #sec_08ce1de8

Correction follows an orderly degradation :

1. Automated Runbook, when REVIEWIT has the appropriate permissions and action;
2. Connected ITSM, for example ServiceNow or Jira, when execution is delegated to the client's ticket system;
3. Internal REVIEWIT task, which constitutes the universal floor.

The channel never changes the owner of the proof. An external ticket is a correlation, not an exit from the process. Its closure is not enough to declare the gap corrected. REVIEWIT continues to carry the obligation and retains the link between the decision, the dispatch, the actions undertaken and the final finding.

The eligibility of an action is checked at the time of campaign design, and again at the time of execution. A permission may be withdrawn in between; the execution then adopts a fail-closed behavior and switches to the channel that allows the obligation to remain visible.

The reviewer sees the result of this prior check before signing: automatic correction available, ticket planned or non-executable action. This information does not modify his verdict, but it makes explicit the real processing capacity at the time the decision is attested.

04Temporary exception does not mean compliance #sec_15a71bc9

An exception suspends the dispatch, never the verdict. The resource remains non-compliant; the risk is accepted for a fixed period, with a justification and a resumption date.

At maturity, the obligation becomes dispatchable again without requiring a new review. The dashboards present these exceptions as accepted and dated risk. Thus, an exception cannot silently become a permanent compliance.

The policy defines the person responsible for the correction, possibly criterion by criterion. If this target is missing, REVIEWIT applies a fallback chain up to the campaign owner. An orphaned resource therefore always retains a responsible recipient.

05Close with the right level of proof #sec_c4c3d392

REVIEWIT does not confuse proof of execution with proof of compliance. A successful call, a closed ticket or a checked box show that an action has been declared accomplished. They do not necessarily demonstrate that the gap has disappeared.

The strongest closure is based on a new collection that confirms the corrected state. When this verification is impossible, the obligation can be closed with a lower level of proof, clearly indicated :

• confirmed: the recollect confirms compliance;
• reported: the channel announces the accomplishment, without possible verification;
• declared: the owner manually confirms the action.

If a recollect contradicts an announced accomplishment, the obligation is reopened and the attempt remains visible. A completion rate is therefore never worth more than the level of proof that composes it.

06In summary #sec_06bae4e3

Remediation maintains the thread of responsibility from the attested gap to the confirmation of correction. It does not lose any obligation during a change of campaign or channel, distinguishes execution from compliance, and makes the real age of the risk visible.