Issues & actions

Findings vs risks

A Finding records an observed deficiency. A Risk describes a possible harmful outcome. Link them, but keep them separate.

Findings

Example: two sampled decisions were made without the required human review.

Create one with New Finding, import critical and high results with Import from Compliance Scan, or let a failed control test or evaluation raise one.
Severity is Critical, High, Medium or Low. A reviewer can reclassify severity with a rationale.
Status moves through Open, In review, In remediation, Resolved, Accepted risk and Closed. A finding can be resolved only once it has notes, evidence or a corrective action.
Record the management response (Pending, Accepted, Challenged or Withdrawn) and use Create remediation to start a corrective action.

Example: unreliable human oversight may lead to inappropriate clinical decisions.

The Risk Register scores each risk as likelihood × impact on 1–5 scales: 20 or more is Critical, 15 or more High, 8 or more Medium, otherwise Low. Risk Heatmap shows the spread.
Record the mitigation and the residual likelihood and impact after it.
Status is Open, Mitigating, Mitigated or Accepted Risk.
Accept risk requires a justification and a future review date. To have the acceptance approved formally, use Request approval with the action Accept residual risk.

Last reviewed 2 October 2026