Issues & actions
Findings vs risks
A Finding records an observed deficiency. A Risk describes an uncertain harmful outcome or exposure. They can be linked but should not be collapsed into one concept.
Finding
Example: two sampled decisions were made without the required human review.
- Record severity, owner, status, supporting evidence, and management response.
- Link the failed control or assurance activity and create remediation.
Risk
Example: unreliable human oversight may lead to inappropriate clinical decisions.
- Record likelihood/impact or the configured score, owner, mitigation, residual risk, and acceptance decision.
- Link observed Findings when they change the understanding of exposure.