How do you find out why a control failed last month?

Quick answer

Open the control and view its history: every check run is stored with its timestamp, result, and the observed values, so "why was this red on June 12?" has a concrete answer months later. You see when it started failing, what the failing values were, what changed around that time, and when and how it was fixed. In OptiTech, the past isn't reconstructed from memory; it's read from the evidence log.

Reading a control's timeline

The control history view lays out the investigation for you:

The transition point. Checks passed daily until June 9, failed from June 10. Whatever happened, happened in that window.
The failing values. Not "backup check failed" but "backup job for the finance system: last successful run June 8." The specifics usually name the culprit.
Correlated changes. The audit log around the transition: an integration credential rotated, a configuration changed, an owner changed. Cross-referencing failure onset with change history is where most root causes fall out.
The resolution. When the finding was opened, who it routed to, what they did, and the passing re-check that closed it, the full loop covered in investigating a failing control.

Why this matters beyond curiosity

Historical explanation is a compliance requirement in disguise:

Auditors sample the past. "Walk me through this failure in your logs" is a standard audit move; a coherent timeline answers it in minutes.
Incident reports need timelines. If the failure was part of a reportable incident, the MSB report's sequence-of-events section comes straight from this history.
Recurring failures reveal process bugs. Three offboarding failures in a quarter isn't three accidents; it's a broken handoff between HR and IT, and the pattern is only visible with history.

The prerequisite is honest logging

None of this works if history can be edited. Check results in OptiTech land in an append-only log; a failure can be resolved but never unhappened. That's the property that makes the history trustworthy, for you and for anyone verifying your compliance state at a point in time.