F- ·

Finding F-\<n> · Origin \<taxonomy · category · element> · Raised \<date>

What it is. What the mechanism actually is, in plain language. A reader who knows the business but not the architecture should follow this paragraph without help.

Why it matters. The consequence. Who is harmed, or what stops working. Size it honestly against what happens today – if the current process is worse, say so.

What was considered and set aside. The controls that were proposed and not taken, each with its reason. This section is the point of the document. A finding that shows only what was found reads as a charge sheet; one that shows what was weighed invites correction.

Treatment. One word – mitigate · accept · share · investigate · refine spec. Anything needing explanation goes in the next line, not here.

Proposed response. What would actually be done. Say plainly where a control is not built.

Residual. What is still true after the proposed response is done. A treatment with an empty residual is rare and has to be earned.

Owner. Who holds it · Status. Raised / accepted / open