Coverage and gaps
What the governing documents leave uncovered, by register. Only accepted verdicts appear here, and one accepted on a debug-capture host is marked as not necessarily a reviewer's.
How to read this report
Verdicts are documentary — what the documents provide for, as written, not operational discharge — so a control verdict speaks to design only: documented is not implemented, and neither is effective. Findings awaiting review appear as counts, never as verdicts; where several accepted findings touch one item, the most severe shows; rejected findings carry no weight. A risk never takes a coverage verdict: the evidence either reaches its failure mechanism, reaches only the design around it, or says nothing.
Risks
Grouped by risk category. For each designated key risk the firm covers it, or holds an examined, recorded reason why not. Last examined 4 Oct 2026 22:49.
| Select | Risk | Evidence reach | Actions |
|---|---|---|---|
| 20 risks · 19 unresolved | |||
| 15 risks · 15 unresolved | |||
| 7 risks · 6 unresolved | |||
| 6 risks · 6 unresolved | |||
| 5 risks · 5 unresolved | |||
| 4 risks · 4 unresolved | |||
| 4 risks · 3 unresolved | |||
| 5 risks · 3 unresolved | |||
| 3 risks · 3 unresolved | |||
| 1 risk · 0 unresolved | |||
A severity badge counts the checks this risk's examinations did not find guarded, and shows the worse severity present.
debug-host acceptance: Accepted on a debug-capture host, where the run or its caller may accept findings itself, so this is not necessarily a reviewer's decision.