Writing findings directors will actually debate
Severity labels mean little when the finding never names the customer path or the money at risk.
A finding that says "monitoring is insufficient" invites a shrug. A finding that says "weekend remittance overrides for Corridor B lacked a second mandate on 14 of 22 sampled days, representing NT$18 million in unchecked movement" invites a decision.
We coach internal teams and board secretaries during board pack facilitation to keep each finding to four parts: observation, risk to customers or capital, evidence reference, and a suggested owner. Severity then becomes a ranking of those risks, not a decorative colour.
Mild reservations about colour coding
Traffic-light systems help agendas move quickly, yet they also tempt writers to inflate amber items so nothing looks neglected. Prefer a short narrative ranking for the five issues that truly need airtime, and park the remainder in an appendix with clear owners and dates.