ComplyWiseHelp CenterOpen ComplyWise
How-toUpdated Oct 2026

The corrective action plan

The corrective action plan (CAP) is the table of findings and actions an audit produces: what was found, how serious it is, who owns the fix, and when it is due. Every package has a CAP tab. Its columns are yours to shape, and findings are rated with a risk rubric the workspace shares across audits.

Before you start

  • You need the Contributor, Editor, or Workspace Admin role.
  • If the auditor sent their CAP as a spreadsheet, keep it to hand: it imports directly.

Rows and columns

Each row is one action. Action # is assigned automatically (the next number up; numbers are never reused) and Status is always present. Every other column is yours: the default layout seeds a sensible set on creation, and the Columns dialog lets you add, rename, hide, reorder, or delete columns, or copy another package's layout (Action # and Status stay; the rest are replaced).

Columns are typed: text, long text, a choice from options you list, a date, a member of your team, a risk rating, or a linked document. Status takes Open, In progress, Done, or Closed. Cells are edited inline in the table. Hiding a column keeps the values entered under it; they reappear when a column with the same name comes back.

Text drafted by the platform team on your behalf carries a Drafted by platform staff marker so your team knows what to review.

The risk rubric

A risk rating is likelihood × impact. A rubric defines the levels on each axis, with criteria, and the bands the products fall into. The platform rubric is a 5 × 5 matrix banded Low (1 to 4), Medium (5 to 9), High (10 to 14), and Significant (15 and above). Your workspace can keep any number of named rubrics (one per audit type, for example) on the Rubrics tab of the Audits page; one of them is the default for new audit packs, and the platform rubric is always available read-only.

Each audit pack scores against one rubric, chosen when the pack is created and changeable from the CAP tab while the pack is open (Show rubric, then pick from the list). Customize opens the editor on the pack's rubric; anyone who can manage audits can:

  • Rename levels and their criteria.
  • Add a band (it splits the last band in two), move a band's boundary (the neighbour adjusts), or remove one (the band before takes over its scores). The bands always tile the whole 1 to 25 range.

When you save, choose Update this rubric (a new version of the same rubric, for every pack using it) or Save as new rubric (your changes become a separate named rubric, which this pack then uses). Open packs re-band their ratings live; a closed pack keeps the rubric and version it was scored with, so a past audit's ratings never change under it. A rubric in use can be archived, never deleted.

Import the auditor's CAP

  1. On the CAP tab, click the import action and drop the auditor's spreadsheet (.xlsx) or choose it.
  2. Columns are matched to your layout automatically; adjust the mapping where a heading differs. Risk columns are read as a band name, a score, or a likelihood × impact pair.
  3. Confirm. Rows are added after any you already have.

Carrying actions forward

The CAP tab of a new package lists Open actions from previous audits, so a finding that is still open follows the audit cycle instead of being re-typed.

Related articles