Ongoing operations
Scan Findings Become Corrective Actions Automatically
Every scan engine produces severity-rated findings, but a high-severity finding is still just a row until someone turns it into a plan. The auto-wire feature makes that translation automatic: every high or critical finding from a scan now creates a corrective action in your compliance plan, linked to the finding, with a target date and evidence required to close.
Transcript
High and critical scan findings no longer sit in a findings table. They become tracked corrective actions with evidence-required closure.
Every high or critical ScanFinding posted via the scan results callback now creates an idempotent item in the tenant-wide Scan Findings plan, linked to the finding.
Those items appear immediately in Assigned to me and overdue views, with a seven or fourteen day target date.
Close it with a verified Evidence Vault file or a passing rescan. Without that, the status to done transition is rejected.
A second report for the same finding does not create a second corrective action. Medium and lower findings stay as findings until you pull them into a plan deliberately.
Why this is required
Knowing something is high-severity is not the same as having a plan to fix it. A regulator's second question is always: who owns this, and when will it be done?
Manual plan generation already created that link, but it required someone to remember to click. An automatic path means a finding that appears overnight is tracked by morning.
What EuroCompliant does
Every high or critical scan finding automatically creates a corrective action in the 'Scan Findings' compliance plan, with a target date of 7 or 14 days and evidence required to close.
The corrective action appears immediately in your assigned and overdue views, with a link back to the original finding.
Closing the action requires verified evidence (either an uploaded file or a passing rescan) so findings cannot be dismissed without proof.
Walking through it
Trigger a scan that finds something high or critical
Any connector/engine pair will do, e.g. a test git repo with a high trivy_vuln CVE or a Prowler critical.
Open /scans →See the corrective action appear
Open Compliance Plans → filter Assigned to me or overdue. The 'Scan Findings' plan now has a todo linked to that finding, with requires_evidence true and a target date 7/14 days out.
Open /plans →Close it with evidence
Attach a verified EvidenceFile or wait for a passing rescan. Without that, the status→done transition is rejected with 400 'Evidence required to close' (or a still-open finding message unless manual_override with evidence is passed).
Open /evidence →The law
Risk management system
A continuous iterative process, a finding that automatically becomes a dated, owned corrective action is evidence that iteration is actually operating.
Accountability (GDPR, borrowed)
Being able to show the plan, the owner and the deadline for every open high, not just the finding itself.
Frequently asked
Does a second scan report for the same issue create a second corrective action?
No for the same finding.id, idempotent per linked_finding_id and only for open/in-progress items. Re-reporting the same title on the same connector is also deduped by title+connector before a new ScanFinding is even created, so no second finding means no second corrective action either.
What about medium/low/info findings?
They are stored as ScanFindings but do not auto-create corrective actions, only high and critical do. Use Auto-Generate with include_scan_findings if you want to pull mediums into a plan deliberately.
Related guides
Compliance plans, milestones, and deadlines
Turn obligations into trackable tasks with deadlines, dependencies, milestones, and a Gantt timeline.
Compliance Roadmaps: Gantt Plans and Corrective Actions
Turn unfinished obligations and scan findings into a Gantt-tracked plan with owners, dates, and evidence-required closure.
Evidence vault & audit trail
Turning completed checklist items into artefacts a regulator can inspect, and the logging duties behind Articles 12 and 26.
Try it on your own systems
Everything in this guide runs in the live product. Start a free trial and follow along with your own data.
Start free trial