Appearance
Inspection Items
An examination report is prose. An inspection item is one confirmed, authoritative observation from it, with an owner, a due date and a link to whatever will fix it.
Candidates and items
| Candidate | Item | |
|---|---|---|
| What it is | A proposed observation extracted from a document | A confirmed authoritative observation |
| Created by | Extraction, AI-assisted | A person confirming a candidate, or creating one manually |
| Authority | None | Full |
| Can be rejected | Yes | Closed rather than rejected |
A candidate is not an observation until a person confirms it
AI extracts and suggests with complete provenance. It never silently creates authoritative records. An authorised person must explicitly confirm each candidate.
Candidate extraction
Uploading an examination report and running extraction produces candidates, each carrying:
| Field | Purpose |
|---|---|
| Source document and location | Where in the report it came from |
| Extracted text | What the extractor read |
| Original wording | The authority's exact words |
| Classification | A suggested category |
| Confidence | The extractor's assessed confidence |
| Provenance | Which model, which pass |
| Status | Pending, confirmed or rejected |
Requires inspection.extract.
Confirming a candidate
Confirming a candidate creates an item and, at the same time, canonicalises it into the platform's ordinary GRC objects:
| Canonical record | When it is created or linked |
|---|---|
Finding (FND-YYYY-NNNN) | Where the observation identifies a deficiency |
Action Plan (ACT-YYYY-NNNN) | Where remediation is committed |
Control (CTL-...) | Where a new or amended control is required |
| Requirement | Where the observation reflects an obligation you should be tracking |
| Evidence | Where evidence is linked to demonstrate the position |
This is the point of the module. A regulator's observation becomes a tracked finding with an owner and a due date, in the same register as everything else — not a row in a separate remediation spreadsheet.
Requires inspection.canonicalize.
What an item carries
| Field | Purpose |
|---|---|
| Ordinal | Its number in the report |
| Verbatim wording | The authority's exact words |
| Internal interpretation | Your technical reading |
| Classification | The observation category |
| Department and owner | Who is accountable |
| Due date | When remediation is committed |
| Linked finding, actions, control, requirement | The canonical records |
| Validation state | unvalidated, internally_validated or independent_validated |
| Closure notes | The governed closure record |
Dual wording
The verbatim wording and the internal interpretation are separate fields and stay separate.
This is more useful than it sounds. Internal interpretations drift — an observation about "inadequate oversight of material outsourcing" gets internally translated into "update the outsourcing register", and six months later the remediation addresses the translation rather than the observation. Keeping both visible prevents that.
Governed item closure
Completing an action does not close an inspection item
An item closes only through explicit governed closure with a recorded validation state. Completing the linked action plan is necessary and not sufficient.
Equally: a submitted formal response may legitimately coexist with open findings and actions still in progress. Responding is not remediating.
Validation states
| State | Meaning |
|---|---|
unvalidated | Remediation reported, not validated |
internally_validated | Validated by a second line function |
independent_validated | Validated by internal audit or another independent party |
Requires inspection.canonicalize for item management, and the closure action to record the validation state.
Manual items
Not every observation arrives in a document. Items raised in a meeting, in a phone call or in a supervisory letter can be created manually with the same fields and the same governance.
Permissions
| Action | Permission |
|---|---|
| View candidates, items and responses | inspection.read |
| Manage inspections and create manual items | inspection.manage |
| Ingest reports and run extraction | inspection.extract |
| Confirm candidates and canonicalise | inspection.canonicalize |
| Generate AI advisory extractions | inspection.ai_assist |
Example
Inspection INS-2026-0002, draft observations received 3 April: 9 observations.
Extraction proposes 14 candidates from the letter. Review:
| Outcome | Count | Reason |
|---|---|---|
| Confirmed as items | 9 | Match the authority's numbered observations |
| Rejected | 4 | Contextual narrative, not observations |
| Merged | 1 | Restated an observation already captured |
Item 4:
| Field | Value |
|---|---|
| Verbatim wording | "The firm's register of material outsourcing arrangements did not include three arrangements identified during the review which, in the supervisor's assessment, meet the materiality threshold." |
| Internal interpretation | "Three arrangements classified internally as non-material meet the supervisor's threshold. The gap is in our materiality assessment criteria, not in register maintenance." |
| Classification | Governance and record-keeping |
| Owner | Head of Third-Party Risk |
| Due date | 90 days |
| Linked finding | FND-2026-0134 |
| Linked actions | ACT-2026-0241 reclassify the three arrangements; ACT-2026-0242 revise materiality criteria |
The internal interpretation is doing real work here. The observation reads as a register maintenance failure; the internal analysis identifies it as a criteria problem. Both are on the record, and the two action plans address the criteria rather than only the three arrangements.
Closure: both actions completed and verified at day 71. The item closed at day 84 with internally_validated after the second line confirmed the revised criteria had been applied across the whole engagement population — not just the three arrangements named.
Troubleshooting
"Extraction produced nothing." The document could not be converted to text, or the AI entitlement is unavailable. Items can always be created manually.
"A candidate has the wrong wording." Correct it during confirmation. The verbatim field should match the authority's document exactly.
"An item will not close." Governed closure requires a validation state to be recorded. Completing the actions is not sufficient.
"I cannot confirm a candidate." Requires inspection.canonicalize.