Blog · Renewals · Problem 14 of 93
The renewal is waiting on last year’s security findings. They’re still open.
· 2 min read · By Case Jones
A year ago a customer’s security review left a list of findings: an access review that never happened, a missing policy, a backup nobody had tested. You agreed to fix them. The renewal is next month, and their reviewer has the list.
What it costs to leave it
Open findings at renewal look like a promise not kept. The customer can delay the renewal, ask for a discount, or escalate to their own management. Worse, they may stop trusting your answers on everything else.
How to close the findings and show they’re closed
The work is usually smaller than it feels. What matters to the reviewer is that each finding has a clear fix and evidence that the fix happened.
- 1
Put every finding in one list
Copy the findings word for word from the customer’s report. For each one, write who owns it, what “closed” means, and the date it will be done.
- 2
Fix the practice, not just the document
If the finding was “no quarterly access reviews”, writing a policy that says “quarterly” isn’t enough. Run the review, and keep the record. Reviewers want the policy and proof that it’s followed.
- 3
Collect evidence as you go
For each fix, keep what shows it happened: the access review export with the accounts removed, the restore test with its date, the training record, the signed policy version. Screenshots with dates are fine.
- 4
Tell the customer before they ask
A short update a few weeks before renewal changes the conversation: each finding, what you did, and the evidence attached. Anything still open gets an honest date and the reason.
- 5
Make sure it doesn’t come back
Most findings return because the fix depended on one person remembering. Put recurring checks on a schedule with an owner, so next year’s review finds them done.
Example
One finding, closed properly
Finding: “Former employees retained access to the support desk.” Fix: offboarding checklist now includes the support desk, owned by IT. Evidence: last quarter’s access review, two stale accounts removed, signed off by the head of support.
Or keep the fixes and the proof in 93 Compliance
Paste the customer’s findings or questionnaire and each item becomes a requirement, tested green, yellow or red against your policies, so you can see what’s really closed.
Recurring fixes become runnable procedures on a schedule: steps go to the right person, overdue steps remind them and then their lead, and each step collects its evidence (photos, files, sign-offs) in a record that isn’t edited afterwards.
Access reviews can be set up in one click from the systems register. The policy builder, procedures and audit package are free, with no card.
- Findings tracked as requirements and tested
- Scheduled procedures that collect evidence
- Quarterly access reviews set up in one click
- An audit package to share the proof
Close the findings
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
What counts as evidence that a finding is closed?
A record that the fixed practice actually ran: a dated review, a test result, an export, a sign-off. A new policy alone usually isn’t enough.
What if we can’t close everything before the renewal?
Say so early, with a date and a reason for each open item. A credible plan is far better than a surprise in the renewal meeting.
Should we share all our evidence with the customer?
Share enough to show each finding is closed, and redact anything about other customers or unrelated internal detail.