Check effectiveness of corrective action

The penetration test report lists its points with a severity and a recommendation, but the company had no register in which each point was followed until it was closed. Points from the report were discussed in meetings and then drifted. The tester noted that earlier points could not be traced to a fix. Without a single place to track the results, a serious point can stay open without anyone noticing.