Validate that agreed actions really work before closure — defined closure evidence, controls operating in practice, residual risk reassessed, partial completion not closed, and overdue high-risk actions escalated.
Verify that agreed actions are really implemented and working — prioritizing by residual risk, obtaining evidence rather than status updates, reperforming key controls and escalating overdue high-risk items.
Document whether a management action was truly implemented and is working, from evidence received and retesting to a clear close, partially close or keep-open decision with rationale.