A failed control is the start of the work, not the end of the report.
When a check fails, Kmetog opens a remediation item with an owner, a due date and a re-test attached. It follows up until the fix is in place and the control passes again, so gaps do not quietly survive until the next audit.
- Control failedRestore exceeded the 4 hour recovery objective
- Assigned to Infrastructure leadSeverity high, due in 5 days
- Reminder sentNo update after 48 hours
- Fix claimed, re-test queuedCloses only on a passing result
Failures arrive with the context needed to fix them.
The ticket carries the failing result, the specific items that caused it and the control it belongs to, so the owner does not have to investigate what went wrong.
- Exact findings. Which accounts, resources or records failed the rule.
- Linked control. The requirement at stake and the frameworks it affects.
- Your tools. Items can sync to the ticketing system your team already uses.
Closed means fixed, and proven fixed.
Marking a ticket done is a claim. Kmetog treats it as one: the original test re-runs, and the item closes only on a passing result with fresh evidence attached.
- Escalation path. Overdue items move up to a named manager on a schedule you set.
- Re-test on claim. The control is tested again as soon as a fix is reported.
- Accepted risk. Where a gap is knowingly accepted, the decision and approver are recorded.
Owned
Routed to the person responsible for the affected system, not a shared inbox.
Dated
Due dates set by severity, so high-risk gaps are not queued behind minor ones.
Chased
Reminders and escalation when a ticket goes quiet or passes its due date.
Verified
Closure requires the original control test to pass again.
What teams usually ask
Do we need to switch ticketing tools?
No. Remediation items can live in Kmetog or sync to the ticketing system you already use, with status kept in step.
What if a fix will take longer than the due date?
Owners can request an extension with a reason. The request, the approver and the new date are all recorded, which is exactly what an auditor wants to see.
Can we accept a risk instead of fixing it?
Yes. Risk acceptance is a recorded decision with an approver, rationale and review date. The control stays visible as accepted rather than disappearing.
No more findings that outlive the audit.
See how Kmetog would track the open items from your last assessment through to verified closure.