Issue and download reports

Phase 9 — one issued snapshot, named views, optional AI narrative, print and file downloads.

Phase 9 does not invent scores. It projects committed P1–P8 into a typed document, then renders views. You can issue a complete report without AI.

What you choose

In the report step you pick:
  • View — executive, engineering, control register, overall risk, overall compliance, or a named vendor
  • Format — on-screen / print (PDF via the browser), Markdown, Word, or JSON
  • Optional row caps for the main tables (independent high / medium / low filters where offered)
Those choices do not recalculate risk. They hide or include sections. In v2 this is one Phase 9 panel, not two screens: risk-band / row-cap at the top, download buttons on the same card, optional Add AI introductions if AI is on, and vendor send/revoke above that when you have named vendors.

Report configuration and downloads

One P9 card: view options, then executive / engineering / control register / vendor-file downloads. Not a separate studio.
One P9 card: filters at the top, named downloads on the same card. Vendor files are one per named vendor.

Optional AI narrative (Call D)

Add AI introductions is one billed call. It can fill introductions and labeled current-practice measures next to pack remediations. It must not change ids, scores, legislation, or partner ranking. If you skip it, templates still complete from the snapshot.

Organisational residual vs vendors

  • Executive / engineering report this organisation’s residual (what you own and assessed).
  • The control register lists vendor-held controls under the vendor’s name. It does not score them as your residual.
  • Overall risk and overall compliance include vendor control state only after you accept the vendor’s answers. Unaccepted answers stay UNKNOWN.
  • Unassessed vendor implementation, including unknown protection on hops to third-party services, stays on the vendor file.
  • Out-of-scope rows are tracked, not scored as your residual.
  • Issued reports compare residual to the appetite ceiling you set in P1 (within / outside / cannot yet be determined).
  • You can email a signed questionnaire to each named vendor from this same panel, then accept or reject their answers. How: Vendors.

After you download

Keep the files in your archive. Server retention is limited — your data. Re-issue after you change upstream phases; Word/PDF are not the place to edit scores. Next: Vendors · Your assessments and data · What you get