SEBI Table C4: Remediation Evidence Checklist

For engineering and QA teams, C4 should be treated as a closure-evidence workflow.

The table records final or current remediation status, but the useful work is the evidence that explains what changed after the initial audit.

Start with issue traceability

Every remediated item should point back to the original finding.

Keep:

• Original issue ID
• Affected page or component
• User impact
• Expected accessible behavior
• Standard reference
• Severity

This makes later verification easier.

Record the remediation action

For each important issue, capture what changed.

Examples:

• Added programmatic label
• Fixed focus order
• Added visible focus indicator
• Corrected ARIA relationship
• Reworked modal focus management
• Updated PDF tags or reading order
• Added captions or transcript
• Fixed contrast or target size

Short, specific notes are better than vague closure language.

Retest with the right condition

Retest notes should describe how the fix was checked.

Depending on the issue, that may include:

• Keyboard-only path
• Screen reader behavior
• Mobile assistive technology behavior
• Browser and device context
• PDF version
• Form error handling
• Component state

The goal is to prove the accessible behavior, not only that code changed.

Track unresolved risks

Not every issue may be closed immediately.

For open or deferred items, capture:

• Why it remains open
• Current user impact
• Dependency or blocker
• Planned remediation path
• Expected timeline
• Interim risk control if any

This keeps the C4 status honest.

Final checklist

Before C4 preparation, ask:

• Can each status be traced to a C3 finding?
• Is remediation evidence available?
• Are retest notes clear?
• Are partial fixes identified?
• Are open issues explained?
• Does the status wording match the tested scope?

If yes, the C4 package is much easier to defend.

Read the original guide on IAAP Audit: https://iaapaudit.com/blog/sebi-table-c4-remediation-final-status-guide