Remediation Process

In real GRC, remediation means turning the identified gap into a corrective action, assigning responsibility, setting a deadline, and then verifying that the problem has actually been fixed.

Remediation Process — Real-Life GRC

Order	Tab	What you do in real life	LondonBuild example
1	Start with Gap	Take the confirmed gap from your assessment.	2 user accounts were not included in the quarterly access review.
2	Identify Root Cause	Determine why the gap happened.	The access-review process relies on a manually maintained user list.
3	Define Remediation Action	Decide exactly what needs to change.	Automate the user population reconciliation before each access review.
4	Define Remediation Objective	State what the fix should achieve.	Ensure 100% of active accounts are included in every quarterly review.
5	Determine Remediation Priority	Prioritise based on risk/severity.	High priority because inappropriate access could remain undetected.
6	Assign Remediation Owner	Give one person accountability for completing the action.	IT Manager
7	Define Tasks	Break the remediation into specific actions.	Configure automated user list → test → update procedure → train IT staff.
8	Set Target Date	Establish a realistic completion deadline.	30 September 2026
9	Implement Fix	The control owner carries out the remediation.	Automated reconciliation implemented.
10	Collect Remediation Evidence	Obtain proof that the fix was completed.	System configuration + updated procedure + test results.
11	Validate Remediation	GRC checks whether the fix actually addresses the gap.	Confirm automated report includes 100% of active accounts.
12	Retest Control	Perform another control test where necessary.	Test the next quarterly access review.
13	Close Gap	Close only when sufficient evidence confirms the issue is resolved.	GAP-001 → Closed
14	Update Risk Register	Update the associated risk and residual risk/status.	Risk reduced after remediation.

Actual LondonBuild Remediation Record

Field	Example
Gap ID	GAP-001
Risk ID	R-001
Requirement	ISO 27001 A.5.18
Control	AC-002 — Quarterly Access Review
Gap	2 of 20 sampled users had no documented access review
Root Cause	Manual user list does not always capture all active accounts
Remediation	Automate reconciliation of active accounts before each quarterly review
Remediation Objective	100% of active accounts reviewed
Priority	High
Owner	IT Manager
Target Date	30 September 2026
Status	In Progress
Evidence Required	Automated report, updated procedure, completed review
Validation	GRC analyst verifies 100% account population
Retest	Next quarterly access review
Final Status	Open → Closed after successful validation

The most important thing

Don’t close a remediation just because the IT Manager says:

“We’ve fixed it.”

You need objective evidence that the fix was implemented and, where appropriate, retest the control.

The logic is:

Gap
↓
Root Cause
↓
Remediation Action
↓
Owner + Deadline
↓
Implementation
↓
Evidence
↓
Validation
↓
Retesting
↓
Gap Closed

And your full GRC workflow is now:

Framework → Requirement → Control Objective → Control Mapping → Crosswalk → Risk Event → Risk Register → Evidence → Testing → Gap → Remediation → Reporting

The next and final stage is Reporting — where you take everything you’ve discovered and turn it into information management can actually use.