Nicholas A. Southern, GRC and Cybersecurity Compliance Analyst

Decision aid

Is it a finding?

Five questions, in the order an assessor would ask them. Answer honestly and the page tells you what you have: a finding, an observation, or homework. At the end it hands you the finding, already in the right shape.

How to playAnswer yes or no. Five questions at most. The verdict comes with a template you can copy straight into the report. Start over any time.

The shape of a finding

Condition as an observed fact with a count or a date. Criteria, with the control number. Cause in one sentence. Effect at full strength. What was tested and how. Credit what worked, then the defect. Recommendation as a change of principle, not a bigger version of the same control.

“Reviewed” and “confirmed” without a method are not findings. Withdraw the nail.

Scroll to Top