QULDEXResources · Glossary
What is remediation in audit and compliance?
What does remediation mean?
Remediation is the practical half of an audit. The finding says what is wrong; remediation is what the organisation does about it.
The word overlaps with corrective action. Corrective action is the formal term in ISO management system standards and stresses removing the cause. Remediation is the wider everyday term for the fixing work.
How do remediation, mitigation and acceptance differ?
Remove the gap so the requirement is met.
Lower the likelihood or impact when the gap cannot be removed yet.
A risk owner formally accepts the remaining risk, with a reason and a review date.
What does a remediation item look like?
A gap found in a patching review.
| Item | What it looks like |
|---|---|
| Gap | 12 servers missing security patches older than 30 days |
| Plan | Patch within 10 working days; add the servers to the automated patch group |
| Owner and date | Infrastructure lead; due 24 Oct 2026 |
| Evidence | Patch report showing all 12 current; group membership export |
| Verified | Security analyst re-scans and confirms; item closed |
This is an illustration written for this page, not a customer record.
What do frameworks expect of remediation?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 10.2 | Nonconformities are corrected, causes addressed, and the effectiveness of actions reviewed. |
| ISO 27001 | Annex A 8.8 | Technical vulnerabilities are evaluated and appropriate measures are taken. |
| SOC 2 | CC4.2 | Deficiencies are communicated to those responsible for corrective action and monitored. |
| NIST CSF 2.0 | ID.IM, RS.MI | Improvements are identified and acted on; incidents are contained and eradicated. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
Why does remediation stall?
No owner
The action belongs to a team and nobody starts it.
Instead: name one person.
Dates that keep moving
Due dates are extended without anyone approving the delay.
Instead: require a reason and an approval for each extension.
Closed without proof
The owner says it is done; nobody checks.
Instead: close only after a second person verifies the evidence.
How does QULDEX handle this?
Each finding becomes an action with an owner, a due date and escalation, closed only after a reviewer verifies the evidence.
Remediation: common questions
What is the difference between remediation and mitigation?
Remediation removes the gap. Mitigation reduces the risk while the gap remains.
What is the difference between remediation and corrective action?
They overlap. Corrective action is the formal term in ISO standards and focuses on removing the cause so the problem does not recur. Remediation is the general term for fixing what was found.
How long should remediation take?
It depends on severity. Set target times by severity in policy, and track each item against them.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- NIST Cybersecurity Framework (CSF) 2.0
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Every gap owned, dated and verified
Controls, evidence, findings and corrective actions in one audit workspace.