| Issue | Entities | Type | Root cause | Test failure | Severity | Status | Age (days) | Due | Flags |
|---|---|---|---|---|---|---|---|---|---|
| Critical patch SLA misses on internet-facing servers Information Security | Data Center OperationsMobile Banking App | finding | Configuration | COE | CRITICAL | OPEN | 212 | 2026-06-15 | OverdueRepeat |
| Orphaned service accounts on IAM platform Identity Engineering | Enterprise IAM Platform | finding | Access management | CDA | CRITICAL | IN PROGRESS | 87 | 2026-07-31 | |
| Payment reconciliation breaks aged beyond SLA Finance Operations | Payment Operations | finding | Process gap | COE | HIGH | OPEN | 223 | 2026-05-31 | OverdueRepeat |
| MSSP log source coverage gaps Information Security | Managed Security Services Provider | finding | Monitoring & logging | CDA | HIGH | OPEN | 167 | 2026-05-31 | OverdueRepeat |
| Privileged access recertification overdue Identity Engineering | Enterprise IAM Platform | finding | Access management | COE | HIGH | OPEN | 87 | 2026-06-30 | OverdueRepeat |
| Customer data access certification incomplete Chief Data Office | Customer Data Domain | finding | Access management | COE | HIGH | OPEN | 113 | 2026-06-30 | OverdueRepeat |
| AML scenario coverage lag for new products Financial Crimes Compliance | AML Transaction Monitoring | finding | Monitoring & logging | CDA | HIGH | IN PROGRESS | 203 | 2026-07-31 | |
| AI human-review override logging absent Digital Strategy | Generative AI Knowledge Assistant | finding | AI governance | CDA | HIGH | OPEN | 60 | 2026-08-15 | |
| Fairness testing skipped for model release Credit Risk Analytics | Credit Decisioning Model | finding | AI governance | COE | HIGH | OPEN | 98 | 2026-08-31 | |
| Onboarding liveness check disabled during incident Digital Channels | Digital Onboarding Journey | finding | Change management | COE | HIGH | IN PROGRESS | 67 | 2026-08-31 | |
| Cloud workloads migrated without architecture review Cloud Platform Team | Cloud Infrastructure Program | finding | Change management | COE | HIGH | IN PROGRESS | 122 | 2026-09-30 | |
| Prior pen test findings unresolved Digital Channels | Mobile Banking App | finding | Process gap | COE | MODERATE | OPEN | 249 | 2026-04-30 | OverdueRepeat |
| EUC inventory stale Finance Controllership | Regulatory Reporting | finding | Process gap | COE | MODERATE | OPEN | 238 | 2026-05-31 | Overdue |
| Credit model documentation incomplete Credit Risk Analytics | Credit Decisioning Model | observation | AI governance | — | MODERATE | OPEN | 195 | 2026-06-30 | Overdue |
| Contact center verification script skipped Customer Experience | Customer Contact Center | finding | Training & awareness | COE | MODERATE | IN PROGRESS | 131 | 2026-07-31 | Repeat |
| Vendor SOC exceptions without management response Procurement & TPRM | Vendor Risk ManagementThird-Party Loan Servicer | observation | Third party | COE | MODERATE | IN PROGRESS | 174 | 2026-07-31 | |
| Manual payment workarounds undocumented Finance Operations | Payment Operations | observation | Process gap | — | MODERATE | IN PROGRESS | 223 | 2026-08-31 | |
| Mobile session timeout inconsistency Digital Channels | Mobile Banking App | finding | Configuration | CDA | MODERATE | IN PROGRESS | 103 | 2026-08-31 | |
| Report lineage gaps for three key reports Finance Controllership | Regulatory Reporting | observation | Data governance | CDA | MODERATE | IN PROGRESS | 205 | 2026-08-31 | |
| Fee change deployed without test evidence Retail Banking | Branch Operations Network | finding | Change management | COE | MODERATE | OPEN | 82 | 2026-08-31 | |
| Marketing consent validation failures Chief Data Office | Customer Data Domain | finding | Data governance | COE | MODERATE | IN PROGRESS | 54 | 2026-09-15 | |
| GenAI responses lack source citation Digital Strategy | Generative AI Knowledge Assistant | advisory note | AI governance | — | MODERATE | OPEN | 111 | 2026-09-30 | |
| Records disposal backlog Legal & Compliance | Records Retention Program | finding | Data governance | COE | MODERATE | OPEN | 141 | 2026-09-30 | Repeat |
| Warehouse restore exceeded RTO Infrastructure Services | Enterprise Data Warehouse | finding | Process gap | COE | MODERATE | OPEN | 118 | 2026-09-30 | |
| IAM policy guardrails not enforced as code Cloud Platform Team | Cloud Infrastructure Program | observation | Configuration | CDA | MODERATE | OPEN | 72 | 2026-10-31 | |
| Regulatory report adjustment tracking Finance Controllership | Regulatory Reporting | observation | Data governance | — | MODERATE | OPEN | 47 | 2026-11-30 | |
| ESG metric definitions undocumented Corporate Sustainability | ESG Reporting Initiative | advisory note | Data governance | — | MODERATE | OPEN | 74 | 2026-12-31 | |
| Emergency change reviews late Core Systems Engineering | Core Banking Platform | observation | Change management | COE | LOW | OPEN | 91 | 2026-10-31 | |
| AML alert backlog above threshold Financial Crimes Compliance | AML Transaction Monitoring | finding | Monitoring & logging | COE | HIGH | CLOSED | 171 | 2025-11-30 | Repeat |
| DLP not extended to chat workspace Workplace Technology | Cloud Email & Collaboration Suite | finding | Data governance | CDA | HIGH | CLOSED | 117 | 2026-01-31 | |
| Loan servicer complaint handling delays Vendor Management | Third-Party Loan Servicer | finding | Third party | — | MODERATE | CLOSED | 166 | 2025-12-31 | |
| HR privileged role cleanup HR Technology | HR Information System | finding | Access management | COE | LOW | CLOSED | 158 | 2025-09-30 | |
| Data center access badge exceptions Corporate Services | Data Center Operations | observation | Access management | COE | LOW | CLOSED | 154 | 2026-01-31 | |
| Wire callback independence lapse Treasury Operations | Wire Transfer Processing | observation | Process gap | COE | LOW | CLOSED | 143 | 2026-02-28 | |
| ATM settlement variance investigation delays Channel Operations | ATM Fleet Operations | observation | Process gap | COE | LOW | CLOSED | 146 | 2026-02-28 |