US OFAC Sanctions Compliance Framework TA.III: Act on confirmed negative test results with compensating controls until remediation

What does TA.III require?

Testing and auditing III: upon a confirmed negative testing result or audit finding, the organisation takes immediate and effective action to identify and implement compensating controls until the root cause is determined and remediated, enhancing programs, software and systems as needed.