Chapter 7 of 13 · Any time
A Failed Control, a Missed Finding, a Paper Control
- I found a control that has not run for months. Am I in trouble?
- An auditor found something I missed. What now?
- How do I report a problem without starting a blame hunt?
Sooner or later you will find something wrong, or someone will find something you missed. This is not a sign you are bad at the job. It is the job. A GRC function that never finds problems is usually not looking.
Three common situations
- A failed control. The quarterly access review did not happen for two quarters. The control exists; it just did not run.
- A finding you missed. An auditor spots a supplier with access to customer data that was never assessed.
- A control that only exists on paper. The policy says logs are reviewed weekly. Nobody has ever done it, and there is no tool that would make it possible.
The third one is the most serious, because everyone believed it was working. It is also the most common. Paper controls usually come from copying a template or writing what an auditor wanted to hear.
How to report it
- Confirm the facts quickly. What is wrong, since when, and what is in scope?
- Tell the control owner and your manager the same day. Do not wait for a perfect picture.
- Write it down: what happened, the impact you know of, what you do not know yet.
- Log it as a nonconformity or issue in your tracker, with an owner and a due date.
- Find the root cause before choosing a fix. "Person forgot" is rarely the real cause.
- Agree a corrective action and a way to check it worked.
The question you might not ask out loud
Should I wait until I have fixed it before telling anyone?
No. Fixing quietly feels kinder, but it removes the chance for the risk owner to decide, and it looks like concealment if it surfaces later. Report first, fix second, and say what you are doing.
Rule of thumb:Use blameless wording. Describe what the system allowed, not who failed. "The review had no reminder and no backup owner" leads to a fix. "Sam forgot" leads to Sam hiding the next one.
When it was your mistake
Say so plainly: "I missed this supplier when I built the list. Here is how I found it and how I will stop it happening again." People trust a GRC person who owns mistakes far more than one who never seems to make any.
Then fix the process, not just the instance. If one supplier was missed, check how suppliers get onto the list. If one control was on paper, sample a few more. One problem is often a symptom.