Explain how an assessment finding should be translated into information useful to senior decision-makers.

### What a good answer covers - Describe the evidence, such as a control gap or test shortfall, rather than reporting only a vague concern. - Explain the potential business impact, including effects on operations, services, privacy, assets, or reputation. - Assign severity using the enterprise's risk strategy and policy. The source gives LOW, MEDIUM, HIGH, and CRITICAL as common categories. - Record serious risks in a risk register, including mitigation plans and status. - Escalate material risks so senior management can provide resources or make an informed acceptance decision. ### The concept A technical finding becomes useful to management when its business consequences are clear. A **risk register** is a record used to communicate and track significant risks, their impacts, mitigation plans, and disposition. It helps decision-makers see whether a risk is being mitigated or accepted. Not every instance of non-compliance needs senior-level escalation; the source says escalation depends on severity and the enterprise's policy. ### Terms - **Severity rating**: a category expressing how serious a risk is. - **Risk register**: a record of significant risks and their management status. - **Non-compliance**: failure to meet an applicable requirement or standard. ### Remember Translate technical gaps into potential business impact before asking management to decide.