Retesting: closing a finding properly

A developer says the problem is fixed. Is it? Retesting turns the claim into evidence.

How it works

1. The team fixes a finding and says which version contains the fix.
2. The tester repeats the original steps against that version.
3. The finding is marked closed, partly fixed or still open, with the result.

Common surprises

• The fix covers one address but not a similar one.
• The problem is solved in the interface but not on the server.
• A change moved the weakness somewhere else.

Good habits

• Retest soon after the fix, while the context is fresh.
• Test the cause as well as the symptom, trying variations.
• Keep the retest result next to the original report.

A closed finding with a recorded retest is something you can show a customer or an auditor. An untested fix is only a good intention.