Field note · 26 November 2025
When a findings memo should stay quiet — and when it should not
Severity grading only helps if your board understands which gaps require budget now and which can wait for the next control cycle.
A findings memo earns its keep when severity grades translate into budget and calendar decisions. Labelling everything “high” trains boards to ignore the page. Labelling everything “medium” hides customer harm.
In audits for fintech controls, we tie severity to two axes: likelihood of examiner challenge and potential customer or integrity impact. A missing deputy for case closure may be medium; systematically late complaints logging that contradicts policy is usually higher.
When quiet is appropriate
Some gaps stay inside the compliance committee while remediation is underway — especially if disclosure timing is governed by license conditions. Quiet is not the same as burying. We document the issue, the owner, and the check-back date.
When silence fails
If a gap affects partner representations you already made, silence creates a second problem. Diligence packs should not claim monitoring coverage you cannot evidence. One neobank partnership team thanked us for narrowing an answer; the follow-up closed faster than a polished overclaim would have.
Request a scoping conversation via contact if you need a memo that boards will actually use.