Most remediation fails at closure, not at planning. An agent can keep the register current, chase owners before dates slip, and check each piece of closure evidence against the criteria agreed when the action was raised. A validator in the second or third line decides whether the action is closed. Extensions go to the committee that set the date.
What is remediation tracking, and who owns it?
Remediation actions come from audit findings, compliance monitoring, incidents, complaints themes, regulatory reviews and self-identified issues. Each should have an owner, a due date, a description of what "fixed" means, and a route to confirm it. Tracking keeps that set honest: what is open, what is late, what was closed and on what evidence.
Action owners do the work. A central function, often operational risk or compliance, runs the register. Validation is done by whoever raised the finding, or by an independent team. A risk or audit committee approves extensions and watches the overdue list. The agent runs the register and checks the paperwork, in line with our guide to AI compliance agents.
What are the steps, and at what depth?
- Agent, depth 1: registers new actions from each source system, carrying the finding reference, the owner, the due date and the closure criteria. An action with no closure criteria is flagged back to whoever raised it.
- Agent, depth 1: links related actions. The same root cause often produces findings from audit, complaints and monitoring. Linking them avoids three owners fixing one problem three ways.
- Agent, depth 3: chases owners at set points before each due date, asking for status and evidence.
- Agent, depth 1: reads submitted evidence against the closure criteria. A changed procedure, a test result, a system change record, a training completion list.
- Agent, depth 2: proposes a closure view: criteria met, partly met or not met, quoting the evidence for each criterion.
- Person, validator: decides closure. Confirms, rejects with reasons, or asks for more.
- Agent, depth 2: drafts extension requests with the history of the action and previous extensions, for the owner to submit.
- Person, committee: approves or refuses extensions.
- Agent, depth 2: drafts the status report for the committee: overdue items, repeat extensions, items closed since the last meeting and the evidence behind them. The draft leads with what the committee must decide, not with the full register.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Register | Records action and criteria | 1 | Writing the criteria |
| Link | Groups by root cause | 1 | Agreeing the grouping |
| Chase | Sends reminders | 3 | Doing the work |
| Read evidence | Checks against criteria | 1 | Nothing |
| Closure view | Proposes met, partly or not met | 2 | Validator decides |
| Extension | Drafts request with history | 2 | Committee decides |
| Report | Drafts committee report | 2 | Presenting it |
Which controls matter, and what evidence does each leave?
Two states of closed. "Closed by owner" and "validated closed" are different, and only the second counts in reporting. Evidence: both states and both names on each action.
Criteria fixed at raising. If closure criteria change later, the change and its approver are recorded. Evidence: criteria history.
Reminders stay factual. Chasers state the action, the due date and what evidence is still missing. They never threaten escalation the agent cannot make or promise leniency it cannot grant. Evidence: the reminder text filed with each case.
Evidence must be the thing itself. A statement that a control was changed is declared; the change record from the system is stronger. The agent marks which kind it received. Evidence: provenance on each item.
Extension history is visible. The committee sees how many times a date has moved. Evidence: the extension log.
The agent cannot close or extend. Its role has no capability to change an action's status to closed or move a due date. Evidence: status changes attributed to named people.
What should you measure?
- Overdue actions, by owner, source and severity.
- Actions with more than one extension, and the reasons given.
- Closures rejected by validators, and the most common missing evidence.
- Reopened actions: issues that recurred after validated closure. These test the quality of the closure criteria.
- Actions raised without criteria, by source.
Where does it usually go wrong?
Closure criteria are vague. "Improve the process" cannot be validated. Push back at registration, not at closure.
Dates roll quietly. An owner moves the date in the source system and nobody notices. The agent should read date changes and treat each as an extension needing approval.
Evidence is a screenshot of a document. Ask for the system record or the approved document itself.
One fix, many registers. Complaint themes, regulatory changes and audit findings each spawn actions. Keep one register; the same discipline applies to complaint deadline tracking with an AI agent and to regulatory update tracking with an AI agent, whose outputs often land here.
Agent-related findings are missed. Findings about the firm's own AI agents belong in the register too. If a withheld actions register shows agents repeatedly attempting actions the platform refuses, that pattern deserves an owner and a fix to the agent's brief.
Where Pryme fits
The tracking agent in Pryme runs at depth 3 for reminders only; closure and extension are outside its role scope, so attempts to change either are refused and filed. Closure evidence carries its provenance class, which lets a validator see at once whether a fix is shown by a system record or only asserted by its owner.
Questions people ask
Can the agent validate low-severity actions itself?
It can propose a closure view for any action. Whether low-severity actions may be closed on that view alone is a policy choice for the committee; if allowed, sample them regularly.
How does this relate to training actions?
Many fixes include training staff. Completion records should come from the training system, as described in whether an AI agent can track compliance training, not from the owner's statement.
What if the owner leaves the firm?
The agent flags actions whose owner is no longer active and drafts a reassignment request. A manager assigns the new owner.