Remediation plans

1) What is a remediation plan (CAPA)

• describes the finding, root cause, and risk;
• assigns owners, measures (corrective and preventive), deadlines and success criteria;
• captures evidence of closure and prevents repetition.

Objectives: to reduce residual risk to the Appetite level, to ensure legally significant traceability and readiness for audit.

2) When a CAPA is needed

Results of audits/assessments (internal and external).
Information security/privacy/operations incidents and their post-mortems.

Deviations of JMA/control tests, KRI in the "red zone."

Violations of contractual/regulatory requirements.
Significant configuration drifts and SoD conflicts.

3) RACI and roles

(R — Responsible; A — Accountable; C — Consulted; I — Informed)

4) CAPA end-to-end

1. Identification: finding statement (fact → criterion → influence → evidence).
2. Risk assessment: severity/likelihood, impact on SLA/regulation.
3. Root Cause Analysis: 5 Why, Fishbone, fault tree - method choice.
4. Planning: SMART measures (Corrective/Preventive), resources, deadlines, KPIs.
5. April: Owner → (at High/Critical) Risk Committee/Exes.
6. Execution: tasks in ITSM/Jira, dependency control, communications.
7. Verification: design and effectiveness test, reperform (if possible).
8. Closing: evidence in WORM, updating control rules/policies.
9. Post-review: 30-60 days later - repeat finding.

5) Prioritization and timing

• Critical: immediately; deadline ≤ 7 days; daily updates.
• High: ≤ 30 days; updates weekly.
• Medium: ≤ 90 days.
• Low: ≤ 180 days.

Priority factors: regulatory implications, customer impact/PII, financial impact, frequency and scale, availability of offsetting controls.

6) CAPA quality requirements

SMART steps: specific, measurable, achievable, relevant, with a deadline.
Bypass: Corrective + Preventive.
Compensatory controls: if the final measure takes time, temporary barriers are introduced (enhanced monitoring, manual checks, reduction of limits).
Communication with policies/controls: update standards, SOPs, CCM rules.
Evidence: a clear list of closure artifacts and how to verify them.

7) CAPA Template (Card Structure)

ID Finding/Source (Audit, Incident, CCM).
Description of nonconformity (actual/criterion/impact).
Risk Rating & Appetite (before/after).
Root Cause (method and outputs).
Corrective Actions (steps, owner, due, KPI, resources).
Preventive Actions (шаги, owner, due, KPI).
Compensating Controls (what, by whom, until what date).
Dependencies (services, vendors, releases).
Evidence List (which is exactly what the closure proves).
Verification Plan (who, how, when, admission criteria).
Status & Updates.
Approvals (signatures/decisions of the Committee).

8) Examples of corrective/preventive measures

Accesses/IAM: revoking extra rights, launching re-cert campaigns, configuring JIT/MFA, SoD auto-escalation.
DevSecOps: enabling SAST/SCA gates, disabling vulnerable dependencies, secret scan in PR.
Data/privacy: correction of retention/TTL, enabling Legal Hold, masking fields.
Logs/proofs: translation to structured logging, WORM/Object Lock, hash chain anchoring.
Vendors: DPA/SLA update, sub-processor audit, data destruction confirmation.
BCP/DR: RPO/RTO increase, regular exercise, reservation.
Processes: SOP update, training, quizzes/appraisals in LMS.

9) Exception management (waivers)

When permissible: "hard constraint" (vendor, regulatory deadlines, architectural restrictions).
Requirements: cause, expiration date, compensatory measures, residual risk assessment, agreement with the Committee.
Control: dashboard, reminders for 14/7/1 day, prohibition of "eternal" waivers.

10) CAPA Portfolio Metrics and SLOs

On-time Remediation (by severity):% of closings on time (target ≥ 95%).
Median Time-to-Close: Median by High/Critical.
Repeat Findings: proportion of repetitions in 12 months (↓ trend).
Risk Reduction Index: ∆ of total risk rate after closing.
Evidence Completeness:% of plans with full set of artifacts (100% target).
Compensating Control Coverage:% high-risk cases with temporary measures (target 100% before the final fix).
Communication SLA: percentage of status updates on time (target ≥ 98%).

11) Dashboards (minimum set)

CAPA Pipeline - Plan → In Progress → Verify → Closed with SLAs/delinquencies.
Severity Heatmap: distribution by criticality and owners.
Risk Impact: risk reduction index and residual risk by domain.
Evidence Readiness: completeness of evidence, progress of verifications.
Waivers & Deadlines: active/overdue, compensatory measures.
Aging & Bottlenecks: age of open CAPAs, bottlenecks (vendors/releases).

12) SOP (standard procedures)

SOP-1: CAPA creation

1. Register finding → 2) assess risk → 3) RCA → 4) form a CAPA card (SMART) → 5) agree.

SOP-2: CAPA Maintenance

Weekly updates (High +) → checking dependencies → fixing evidence → adjusting dates with an update.

SOP-3: Verification of closure

Design/effectiveness test → reperforms (if applicable) → closure decision → evidence archive in WORM.

SOP-4: Post-Review

After 30-60 days - verification of the absence of repetitions, adjustment of controls/policies.

13) Definition of Done

All steps completed; KPIs achieved.
Compensatory measures are removed or embedded as permanent controls.
Updated policies/standards/SOPs/monitoring rules.
Collected and archived evidence (hash receipts, links).
Verified by independent party (Compliance/Internal Audit).

14) Antipatterns

"Plans on paper": no owner/deadlines/metrics → eternal discoveries.
"Done - not proved": no evidence/reperform.
Only Corrective without Preventive → replays.
Waivers with no expiration dates and no compensation.
Shifts in deadlines without an update and risk analysis.
CAPAs "in isolation" from policies/JMAs - controls not updated.
Lack of communications and statuses for stakeholders.

15) Integrations

GRC/ITSM: unified register of CAPAs, links with findings/incidents, SLAs/escalations.
CCM/Compliance-as-Code: automatic tests of controls for verification.
Evidence Storage: WORM/Object Lock, anchoring, access log.
Policy Lifecycle-The path of policy changes associated with the CAPA.
LMS: training/quiz on new requirements.
VRM: vendor actions, mirror retention, confirmation of destruction.

16) Maturity model (M0-M4)

M0 Hell-hoc: scattered plans, no timeline/evidence.
M1 Catalogue: Unified CAPA register, baseline dates and statuses.
M2 Manageable: SLA/dashboards, evidence, regular updates, role responsibility.

M3 Integrated: link to CCM/GRC/Policy-as-Code, reperform, "audit-ready by button."

M4 Continuous Assurance: predictive KRIs, CAPA auto-triggers, prioritization recommendation engines, repetition prevention.

17) Related wiki articles

Interaction with regulators and auditors

Risk-Based Audit (RBA)

Continuous Compliance Monitoring (CCM)

KPIs and compliance metrics

Storage of evidence and documentation

Logging and Audit Trail

Compliance Policy Change Management

Due Diligence and Outsourcing Risks

Total

An effective CAPA is not a "task list," but a manageable risk mitigation system: clear prioritization, SMART measures, evidence and verification, updating controls and no repetitions. This approach makes compliance predictable, reduces the cost of incidents and strengthens the confidence of regulators and businesses.