Reports

A report turns a completed assessment into a document: the score, the answers, the findings, and what you decided to do about them.

Generating a report

Generate from the assessment once review is done. Generation is recorded on the assessment activity log, so it is always clear which version of the answers a report was rendered from.

Reports are versioned. Regenerating after a resubmission produces a new report rather than overwriting the old one — useful when a vendor's second attempt is materially better than their first and you need to show both.

What a report contains

Summary

The vendor, the questionnaire, the dates, and the overall score with its risk level (low, medium or high).

Section scores

Scores per questionnaire section, weighted by the per-question weights set in the questionnaire. A section that carries more weight moves the total more.

Findings

Every finding raised by the answers, with its severity and the answer that produced it. Findings that were disputed, accepted or remediated carry that state with them.

Recommendations

The follow-up actions agreed with the vendor, tied back to the findings they address.

Sharing

Reports are stored privately and served through the platform, never from a public bucket URL. Share by giving a colleague access inside the platform, or by downloading the document and sending it yourself when the recipient is external.

Comments

Report comments are threaded and stay attached to the report, which keeps the back-and-forth about a finding next to the finding rather than in a mail thread nobody can find later.

Risk snapshots

Each completed assessment leaves a risk snapshot on the vendor. Over several assessment cycles these show whether a vendor's posture is improving, which is usually a more useful signal than any single score.