Finding
What is Finding?
A conclusion drawn from audit evidence that identifies a condition, criteria, cause, and effect. Audit findings range from major nonconformities to minor observations and recommendations for improvement.
Terms that appear alongside finding
Each of these is named in at least one of the same controls as finding. The number is how many controls name both.
- remediation 9 shared controls
- corrective action 4 shared controls
- gdpr 3 shared controls
- compliance 3 shared controls
- audit 3 shared controls
- observation 2 shared controls
- transparency 2 shared controls
- data protection 2 shared controls
Frameworks that govern finding
What the standards actually require on finding
Requirements naming finding across 6 standards, quoted from the control text.
The technical report must detail each finding with severity, evidence, reproduction steps, business impact, and remediation guidance, supporting both engineering and audit consumption.
PTES-REP-2 · Technical Findings →Address CAT III (Category III, low severity) STIG findings, which degrade measures to protect against loss.
STIG-SEV-CAT3 · Category III (low severity) finding remediation →Aggregate security telemetry into standardised destinations such as S3 log archive buckets, Security Hub and a centralised SIEM so analysts and automation can correlate across sources.
SEC04-BP02 · Capture logs, findings, and metrics in standardized locations →Base the assessment on presented evidence and facts, ensuring depth and coverage support an accurate determination of control effectiveness.
IRAP-EV-3 · Objectivity of findings →Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.
CIS-18.3 · Remediate Penetration Test Findings →Section 6 of KOSA mandates comprehensive transparency reporting by covered platforms. (1) Section 6(a) Annual Public Transparency Report: (a) Covered platform must publish annual report on safety practices;
KOSA-Transparency-Reporting-Section6-Annual-Disclosure-Risk-Assessment-Independent-Audit-Researcher-Access-Public-Report · KOSA Transparency Reporting + Section 6 + Annual Public Disclosure + Risk Assessment Findings + Independent Audit Results + Researcher Access Reports + Public Report + Reporting Mechanism Statistics + Content Moderation Metrics + Algorithmic Disclosure →Questions people ask about finding
What is Finding?
Why is Finding important for compliance?
Which compliance frameworks address Finding?
Where can I learn more about Finding?
See how Finding applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.