> ## Documentation Index
> Fetch the complete documentation index at: https://docs.conformly.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Findings

> Triaging, remediating, and discussing compliance gaps

<style>
  {`
      p, li {
        text-align: justify;
        text-justify: inter-word;
      }
    `}
</style>

## What a finding is

A finding is one specific gap the AI pipeline identified between your
document and a standard's requirements. Every finding has:

* **Standard + clause** — e.g. "ASPICE 3.1 SWE.4" or "ISO 26262-6 §9"
* **Title** — short label
* **Description** — what's wrong, in plain English
* **Severity** — Critical, High, Medium, or Low (driven by safety
  classification, capability level, and the underlying gap type)
* **Remediation status** — Open, In Progress, Resolved, Accepted
* **Suggested fix** — concrete recommendation from the AI
* **Source document + page** — where the finding came from
* **Cross-standard claims** — when the [Knowledge Graph](/user-guide/knowledge-graph)
  detects that the same evidence affects clauses in other standards

Findings are stored independently of the analysis run that created
them, so they survive re-analyses, document updates, and workspace
reorganisation.

## The Findings page

Open it from the sidebar. You see a table with all findings in your
current workspace, filterable by:

* **Severity** — Critical / High / Medium / Low / All
* **Remediation** — Open / In Progress / Resolved / Accepted / All
* **Standard** — only shown when you have findings from multiple standards
* **Product** — only shown when you have [products](/user-guide/products) defined
* **Document** — only shown when you have findings from multiple documents
* **Free-text search**

All filters are URL-state, so you can bookmark or share a filtered view.

The table also has a free-text search box for searching titles and
descriptions, plus the standard column-header click to sort.

## Severity vs Remediation — the most common confusion

**Severity** is the AI's risk assessment of the finding itself. It
answers "how bad is this gap?" and is based on safety classification
(ASIL), capability level distance from target, and gap type. You
cannot change a finding's severity — it's a fact about the finding.

**Remediation** is your team's workflow state on the finding. It
answers "what action have we taken on this gap?" and you change it
manually as work happens. The four states are:

| State           | What it means                                                                | When to use it                                                                                                               |
| --------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **Open**        | Identified but not yet addressed.                                            | The default for any new finding.                                                                                             |
| **In Progress** | Someone is actively working on the fix.                                      | When you start remediation work.                                                                                             |
| **Resolved**    | Fixed in your document. The next analysis should not reproduce this finding. | When you've made the change.                                                                                                 |
| **Accepted**    | Acknowledged as an acceptable risk. Will not be remediated.                  | When the cost of remediation exceeds the risk reduction — typically with a documented justification and management sign-off. |

"Accepted" is a valid audit outcome. ISO 26262 explicitly allows risk
acceptance for non-safety-critical findings with proper rationale. Use
it sparingly and with documented justification — auditors will ask why.

## The status column header reads "Remediation," not "Status"

This is deliberate. "Status" is jargon — it's unclear whether it means
the AI's verdict or the team's workflow state. "Remediation" is
unambiguous: it answers "what have we done about this?" Hover the
column header in the Findings table for an inline tooltip explaining
the four values.

## Bulk actions

Select multiple findings using the checkboxes in the leftmost column.
Once you have a selection, the bulk action bar appears at the top:

* **Bulk update remediation** — change all selected findings to a new state
* **Bulk export** — download as CSV
* **Bulk dismiss** — mark as Accepted with a single click

Useful when triaging a fresh analysis result with 50+ findings.

## Discussion threads

Every finding has its own comment thread. Open by clicking the row to
expand it — the discussion appears at the bottom alongside the suggested
fix and the page reference.

Anyone with Editor or above can post comments. Viewers see the
discussion but cannot post. Use comments for:

* "I disagree with this finding — see section 4.3 of the doc"
* "Assigned to @pat to fix in next sprint"
* "Linked to JIRA-1234"
* "Resolved by commit abc1234 — please re-run analysis"

Comment authors can delete their own comments. Workspace admins can
delete anyone's comments. The full edit history isn't preserved — if
you need formal change tracking, use your existing change-management
system and link to it from the comment.

Comments survive re-analyses. So when a new analysis re-detects the
same finding (because the document hasn't been updated yet), the
existing discussion is still attached.

## Verifying a resolved finding

When you mark a finding as Resolved, Conformly offers an optional
"Verify Resolution" check that re-runs a lightweight analysis on
just that finding's clause and confirms the document now satisfies it.
The check looks at the latest version of the source document — so the
intended workflow is:

1. Mark the finding Resolved
2. Update the source document
3. Re-upload the document (Conformly detects the version change)
4. Click Verify Resolution on the finding

If verification passes, the finding gets a green "Verified" badge that
auditors can rely on. If it fails, the finding flips back to In Progress
with a note explaining why.

## Exporting findings

From the Findings page, click Export → CSV (or PDF for the formatted
report). The CSV includes every field including the comment count and
verification status. The PDF is the same data formatted for an audit
review meeting.

## Asking the AI for help

Each finding has an "Ask AI" button that opens a chat panel scoped to
that specific finding. The AI has access to:

* The finding itself (title, description, severity, suggested fix)
* The source document (so it can quote specific sections)
* The relevant standard clause
* Your prior conversation in the same thread

Use it for things like:

* "Show me what 'bidirectional traceability' means in ISO 26262"
* "Suggest exact wording for the change request"
* "What evidence would actually satisfy this clause?"
* "Is this finding related to any other gaps in the same document?"

The AI's answers are not stored as part of the finding itself — they
live in the chat thread only. If you want a piece of AI output to
become an action item, copy it into a comment.