Service and plan: [exact scope]
Intended use: [document types and audiences]
Required control: [specific requirement]
Vendor statement: [answer]
Evidence reviewed: [document title, scope and period]
Harmless test result: [observed result or not tested]
Remaining gap: [unresolved issue]
Decision owner: [role]
Decision and conditions: [accept / mitigate / reject / pending]