Submit the Complaint Intake Form using the webform below. If you are unable to access the webform, please send an email to [email protected] with the required documents.
2. ISACA Conducts Preliminary Investigation
Within 15 days of a Complaint being received, ISACA will conduct a preliminary investigation to determine if the complaint meets the eligibility criteria.
3. If the Complaint has merit
ISACA will inform impacted parties that a complaint potentially impacting them has merit and is being investigated. ISACA will determine next steps regarding an audit or additional investigation.
4. ISACA Drafts Investigation Report
A member of the CMMI Complaints and Corrective Action Appeals Team will draft an investigation report using the results of the preliminary investigation based on the CMMI Investigation Procedures.
5. Trigger Full Investigation Process (if necessary)
If found necessary, trigger the full CMMI Investigation Procedures, which is a subprocess to the Complaints Process.
6. Trigger Full Audit Process (if necessary)
If found necessary, trigger the CMMI Audit Process, which is a subprocess to the Complaints Process.
7. Draft of Investigation or audit report is submitted to the Respondent
The Complaint Case Lead will provide a draft of either the investigation or audit report to the Respondent.
8. Respondent submits CMMI Complaint Response Form
The Respondent is required to submit their response to the investigation or audit report within 30 calendar days by completing the CMMI Complaint Response Form and returning it to the CMMI Complaints and Corrective Action Appeals Team.
9. ISACA Reviews Response Form
A member of the CMMI Complaints and Corrective Action Appeals Team will review the Respondent’s response form and amend the investigation report accordingly.
10. Trigger Corrective Action Process (if necessary)
If found necessary, trigger the Corrective Action Process, which is a subprocess to the Complaints Process.
11. ISACA Provides Final Report
The Complaint Case Lead will provide the corrective action report to the Respondent within 30 calendar days after the finalization of investigation/audit report. Inform Respondent’s Impacted Parties of the results of an investigation or audit and corrective action (if applicable) potentially impacting them. Respondent’s Impacted Parties should only be provided with the minimum amount of information required to mitigate associated risks.
If you have have a complaint that fits the criteria above, you may click the button below to access the webform: