Raising and closing findings

What a finding is #

A finding is one observation with everything a reader needs to act on it:

• The observation, in one or two sentences.
• The clause or control it relates to, chosen from the framework's list or written in.
• Severity: minor, major, or an observation.
• What would satisfy it, so the company knows what "addressed" means.
• Evidence you attach from the register.

Raise findings as you go, not at the end; the company can start on them while the engagement runs.

The response #

The company writes its response into the finding: what has been done or is planned, and by when. You get a notification. Then you decide:

• Addressed: the response and the evidence satisfy the finding. Write why; the note stays on the record.
• Still open: keep it open with a note on what is missing.
• Withdrawn: the observation does not stand. Write why.

Each decision is recorded with its note and date. A finding is never deleted; a withdrawn one stays in the register marked as such.

Findings and the report #

The findings register is the substance of your report. Deliverables you attach to milestones, such as the report itself, should match it; a company reading both will compare them.

Severity and the company's view #

The company sees every finding the moment it is raised, with its severity. There is no draft state visible only to you, so write a finding when you are ready to stand behind it.