Severity and closure of AI audit findings

A finding brings together the criterion, the observed condition and the evidence that supports it. It separates an established cause from a hypothesis, then describes plausible effect, likelihood, extent and the effectiveness of existing controls. The remedy follows: otherwise a preferred solution distorts the diagnosis.

Criterion

The rule, objective or requirement against which the fact is examined

Condition

What was observed for an identified version and population

Effect

The plausible consequence, its extent and affected people or services

Decision

Correct, restrict, suspend, refuse or formally accept the risk

Severity derives from plausible effect, likelihood, extent and the actual ability of controls to prevent, detect and correct the deviation. The rule is stated in the mandate or work programme. It must produce the same class when the same facts and assumptions are replayed.

A disagreement over severity is not absorbed into an average. The parties identify the disputed fact, missing evidence or different assumption. If challenge does not resolve it, the conclusion retains the residual position.

The scope owner may correct a factual error, provide evidence, challenge an interpretation or accept the finding. The response is examined and retained. The auditor remains responsible for the final wording, proposed severity and limits; management remains responsible for the decision and any acceptance of risk.

A promise to correct, a closed ticket or a new procedure is not enough. Closure requires an explicit decision, an owner, a deadline, evidence of implementation and a successful verification test — or formal risk acceptance by the competent authority.

The conclusion separates established facts, interpretations, unverified elements and persistent disagreements. It states the assurance obtained and residual risk, then ties each decision to the authority that owns it. Traceability is not there to lengthen the report: it makes the decision to maintain, restrict or refuse defensible.