Findings & Recommendations Register
The workpapers document how testing was done. This holds what the engagement is judged on: each finding, the criteria it is measured against, the recommendation, what management actually said, who owns the remediation and whether it closed. The panel counts what is past the date agreed with management, what has no response in writing, and what is marked closed-verified with no verification date - which is the first thing a peer reviewer tests. No rating scale is imposed: you record your methodology's wording.
Your database
Fields
| Field | Type |
|---|---|
| Finding reference | text |
| The finding | text |
| Criteria / standard it is measured against | text |
| Effect if unaddressed | text |
| Rating (your methodology's wording) | text |
| Recommendation | text |
| Management response | text |
| Owner | text |
| Agreed remediation date | date |
| State | select |
| Closure verified on | date |
Frequently asked
Where is this stored?
Only on this device, in your browser. Nothing is uploaded and there is no account. Export to CSV or JSON to back it up, hand it to an auditor, or move it to another machine.
Does it know my deadlines and required frequencies?
No, and that is deliberate. Inspection intervals, retention periods and review cadences are set by your standard, your jurisdiction, your certifier or your own procedure, and they change. This runs offline and cannot know if one changed last month, so it never asserts one. You enter the dates that apply to you and it does the arithmetic on those.
Does it rate findings for me?
No. Rating scales belong to your methodology or your client's, and a remediation window like 'thirty days for a high' is somebody's policy rather than a universal rule. You record the wording and the date you agreed, and the register reports against those.