What is your methodology and timeline for issue validation projects? When validating issue remediation, do you focus only on assessing the design of controls or do you also evaluate their operating effectiveness? Do you have different approach for high risk issues vs lower risk issues? 

My guidance is this:
1. Low risk issues can be closed with control owner attestation or simple inquiry.
2. Medium risk issues can be closed with observation or examination.
3. High risk issues are closed with either reperformance or substantive testing.

Of course, the devil is in the details. It depends on the actual issue itself and a bit of context around the overall audit engagement's results. For example, if an audit is issued with an Unsatisfactory opinion and there were five medium risk issues, one high, and three low, we'd likely follow the guidance above. If it was an engagement and we noted it was satisfactory, with one medium risk issue, we very well might just perform inquiry/observation. 

Our timeline is 30 days from notification that the issue has been resolved. We focus on the design of the controls and periodically will evaluate the operating effectiveness of the controls. His risk issues have a third level of review by the Chief Audit Executive.