Findings
Risk register row
One line of the narrative register a board reads, deliberately capped in number while disclosure of every failed control stays complete.
What it is
A row in the narrative risk register: the control, its severity, its governance implication, its materiality band with the rules that produced it, and the first action.
Why the register is capped
Because it is a table a board reads. A register of two hundred rows is not read, and an unread register governs nothing.
Why the cap is not a disclosure limit
The Complete Control Index carries every failed control at every severity, and so does the Evidence Register, which is available on request. The capped table plus the index always account for the full failed count.
The predecessor of this design capped the only place findings appeared at all, and left the large majority of failures invisible.
What determines the ranking
Severity first, then reach. Ranking is not a work order: a contained finding on a production resource may matter more to you than a broad one elsewhere, and the assessment cannot know which is which.
What it does not mean
A control absent from the register is not a control that passed. It is a control that did not rank into a bounded table.