Accept a finding as a risk
When a finding is a false positive or a known trade-off: accept it with a justification, a scope, a review date and an optional expiry.
Not every finding needs a fix. Some are false positives; some are a trade-off you made knowingly, with another control that covers the risk. Accepting such a finding takes it out of the score and records the decision in the risk register, with the justification an assessor will ask for.
On every plan, an accepted finding leaves the score. The review and expiry dates, the reminders and the register with its export are included from the Solo plan.
Accept a finding
- On the domain’s page or in a report, press Accept this finding under the finding.
- Choose why the risk is accepted: false positive, compensating control, business need, fix planned, or other.
- Write the justification: why this risk is acceptable, in words an assessor can read (10 characters at least).
- Describe the compensating measures, if any: what reduces the risk meanwhile (monitoring, another control, a limited exposure…).
- Choose the scope: this target on this domain only, or every domain in the workspace.
- Set a next review date (optional; you are reminded 14 days before) and an expiry date (optional; after it, the finding counts again).
- Press Accept and add to the register.
Only owners and admins can accept findings. Info findings, which weigh nothing, cannot be accepted.
What changes
- From the next audit, the finding is left out of the score and of the open findings. It stays visible in the report, under Accepted findings, with its reason and its expiry.
- It is no longer sent as a new ticket, and it is listed apart in the compliance view.
- The person who accepted it becomes its owner in the register, where the owner, the dates and the justification can be changed later.
- The public badge, if you show one, says how many findings are accepted.
When an acceptance ends
An acceptance is never deleted. It ends when it expires (the finding counts again from the next audit) or when someone closes it in the register with a reason, for instance once the problem is fixed. Closed risks stay in the register with their history and can be reopened. See The risk register.