The Issues module contains all issues, which are automatically generated from indicator or attestation results.

Issues are created in any of the following ways:
  • Automatically, if the indicator result is Failed or Not Passed.
  • Automatically, if the attestation result is Not Implemented.
  • Automatically, if the control test effectiveness is Ineffective and the state of the test is Closed Complete.
  • Manually to document audit observations, the intention of remediations, or to accept any problems.

Remediating an issue marks an intention to fix the underlying issue causing the control failure or risk exposure. Accepting an Issue marks an intention to create an exception for a known control failure or risk. Controls that are "Accepted" remain in a non-compliant state until the control is reassessed. In both of these cases, the Issue can be used to document observations during audits.