Close or Carry

1. Action: implement quarterly access reviews. Evidence: two completed review packs with reviewer sign-off, covering the last two quarters.

2. Action: update the finance procedure. Evidence: an email from the owner saying it was updated last month.

3. Action: remove twelve leavers' accounts. Evidence: a screenshot showing all twelve disabled, dated the day the action fell due.

4. Action: implement automated three-way matching. Evidence: the team bought a tool, configured it in test, and has a go-live date next quarter.

5. Action: introduce dual approval for payments over £50,000. Evidence: the system now requires dual approval over £250,000.

6. Action: train all managers on the expenses policy. Evidence: a completion report showing 340 of 380 managers trained.

7. Action: appoint a named owner for supplier assurance. Evidence: a new cross-functional committee has been made responsible. No individual is named.

8. Action: restrict administrator access to named individuals. Evidence: the current admin list, showing four named people. The original finding said there were four.

9. Action: perform an annual DR test. Evidence: a test report dated last month recording that the test failed to meet its recovery objective.

10. Action: implement logging on the payments API. Evidence: a change ticket marked Complete, and a log extract showing entries from the last two weeks.

11. Action: reduce the reconciliation backlog to zero. Evidence: a dashboard showing zero, exported today. The backlog was 400 items and the team size has not changed.

12. Action: reduce privileged accounts from forty to twelve. Evidence: a current extract listing thirty-one privileged accounts.