← All documentation

Findings

A finding is a documented gap — something an assessment showed isn't fully in place. Findings are how you track what needs fixing and prove to an auditor that you're managing it.

Where findings come from

  • Generated automatically when you complete an assessment: every question answered No or Partial becomes an open finding, carrying its risk level and the requirement it relates to.
  • Added by hand for gaps you discover outside an assessment (use **+ New finding**).

A generated finding links back to its source assessment — open it to see the exact question and your answer.

Working a finding

  • Risk level (critical → informational) drives prioritization.
  • Status: open → in progress → resolved (or accepted as risk / false positive). Set a risk treatment (mitigate / accept / transfer / avoid) to record your decision.
  • Applies from: a finding on a question whose obligation, on the pack's reading of the law, starts on a later date shows Applies from that date instead of its status (the question's guidance states the date and its source; confirm the reading with counsel). Until then it is readiness work: it is not counted as an open finding on Home, the register's tiles or reports, nor in the findings part of the compliance score (the assessment score still counts the answer), and the register's Applies later filter lists it. On the date it becomes an open finding everywhere, with nothing to do.
  • Assign a finding to a teammate; they're notified.
  • Evidence: attach the artifacts that prove the gap is closed.
  • Tasks: break the fix into tracked tasks — see the Tasks panel on the finding. Watney can draft them for you.

Tips

  • Resolve a finding only when you have evidence the control is implemented and operating — that's what an auditor checks.
  • The compliance score weights open findings heavily, so closing them is the fastest way to raise your posture.

Sorting the list

Click a column header to sort the register by that column; click again to reverse it. The sort is applied on the server, so it orders the whole register — not just the rows on the current page — and it is kept when you page through the results or change a filter. The active column shows an arrow, and screen readers announce it through the header's aria-sort state. Twelve of the fifteen register lists sort on the server this way; the evidence, remediation and vendor lists still sort the rows currently displayed.