A finding is more than a warning

A red number can attract attention. It does not explain what an organisation should do. A finding becomes useful when it identifies a specific object, a documented observation and the context that makes it relevant.

Good evidence allows another person to understand the basis and assess whether a recommendation fits the organisation’s actual needs.

Source, collection time and scope

Access data is a snapshot. A membership may have changed since collection, or a role may apply to a different scope than the reader assumes. Time and boundaries need to travel with the result.

  • Source: Which system and data source reported the information?
  • Identity: Which stable object ID does the finding refer to?
  • Time: When was the information collected and analysed?
  • Scope: Which areas and relationships are included?

Unknown does not mean safe

If a source was not collected, the absence of findings is not evidence of the absence of risk. Missing authentication data, for example, does not establish that every user has adequate MFA protection.

Distinguish at least three states: a documented finding, a completed check without findings, and an area that has not yet been assessed.

This also matters when comparing assessments. A change in findings may reflect changed permissions, but also a wider scope or additional sources. Compare only when the evidence base is understood.

From observation to responsible action

A recommendation needs to match the confidence and reach of a finding. Unknown ownership may require clarification. A broad role may require a business need review. Neither should automatically trigger a permission change.

Corinio’s approach supports this assessment through visible relationships, sources and limitations. Responsible people decide whether a change is appropriate and carry it out through the organisation’s approved process.

Corinio · An introduction

Visit the resource centre