How long is a typical report?

Between 24 and 60 pages depending on scope. The executive summary is always one page, and every finding is written to stand alone so you can forward a single entry to a vendor or counsel.

What format is it delivered in?

A designed PDF for distribution, plus a machine-readable findings register (CSV/JSON) and, on request, tickets pushed straight into Jira or Linear.

Can we share it with customers or counsel?

Yes. Reports are written to be shared under NDA with enterprise buyers, insurers, and outside counsel. We also produce a short customer-facing summary on request.

How is severity scored?

Each finding gets three independent scores — likelihood, exposure, and remediation cost — which roll into a single priority. We show the inputs so you can challenge or re-weight them.

Sample report

A report your board and your engineers can both use.

Below is the report structure, live scorecards, and a set of redacted findings drawn from real engagements.

Request the full PDF Book a scoping call

pages: 24–60
business days: 10–15
severity scoring: 3-axis
evidence-backed: 100%

Preview of a ComplyMynt audit report showing the executive summary and scored findings register — Redacted excerpt — severity scoring, evidence links, and the remediation backlog are included in the full document.

Scorecards

Domain scores, with the evidence behind every number

Scores are recalculated on each re-scan so you can show progress rather than assert it.

Privacy & consent

12 findings

Accessibility

9 findings

Public security

4 findings

AI governance

7 findings

Structure

What is inside every report

1. Executive summary
One page. Posture, top three exposures, and the recommended sequence of work.
2. Scope & method
Surfaces tested, jurisdictions considered, tooling used, and explicit exclusions.
3. Compliance scorecards
Domain-level scores with the evidence behind each number, trended across re-scans.
4. Findings register
Each finding scored by likelihood, exposure, and remediation cost, with evidence attached.
5. Remediation backlog
Written as tickets: owner, acceptance criteria, effort estimate, and regression test.
6. Monitoring plan
What to re-verify, how often, and which signals indicate drift.

Redacted findings

Example entries from the register

Expand any finding to see the evidence attached and the remediation we would ship.

CM-014CriticalConsent

Analytics and ad trackers fire before consent

Six third-party trackers set identifiers on first paint, ahead of any banner interaction, in all tested EU sessions.

Evidence attached

HAR trace of first paint showing tracker requests before consent
Annotated screenshots of the banner in the pre-interaction state
Reproduction steps for a clean EU session profile

Remediation shipped

Gate all non-essential tags behind the CMP consent signal
Add a server-side check that blocks tag injection without a stored consent record
Ship a CI test asserting zero third-party requests before consent

CM-027HighAI

AI feature lacks required automated-processing disclosure

Model-assisted scoring affects user outcomes with no disclosure, opt-out path, or human review documented.

CM-033HighTCPA

SMS opt-in lacks express written consent language

Checkout capture bundles marketing SMS into terms acceptance and stores no timestamped consent record.

CM-041MediumAccessibility

Primary onboarding flow is not keyboard operable

Custom dropdowns trap focus at step two, blocking screen reader and keyboard-only account creation.

Coverage

Every domain, counted and evidenced

The register opens with this table so leadership can see the shape of the risk in ten seconds.

Example findings coverage by domain and severity
Domain	Critical	High	Medium	Method
Privacy & cookies	2	4	6	Network traces, CMP behavior, policy review
AI governance	1	3	3	Model/data flow mapping, vendor terms, disclosures
TCPA & marketing	1	2	2	Form capture, opt-out testing, record review
Accessibility	0	3	6	WCAG 2.2 AA automated + manual AT testing
Public security	0	1	3	Header/TLS posture, exposed surface, disclosure

Remediation

What the same surface looks like after the fix

Remediation impact

Before

Before audit

6 trackers firing before any consent interaction
No timestamped record of SMS marketing consent
Onboarding flow unusable by keyboard at step two
AI scoring shipped with no disclosure or opt-out

After

After remediation

Zero non-essential requests before consent, enforced in CI
Express written consent captured and stored with proof
Full keyboard and screen-reader path through onboarding
Automated-processing disclosure with human review path

Audiences

One document, three readers

For your board

A one-page posture read, the three exposures that matter, and what each costs to close.

For your counsel

Evidence-backed findings mapped to GDPR, CPRA, TCPA, ADA/WCAG, and state privacy expectations.

For your engineers

Reproduction steps, acceptance criteria, effort estimates, and regression tests per ticket.

Timeline

From kickoff to walkthrough in 15 business days

Day 1
Kickoff & scope sign-off
Day 2–6
Evidence collection under NDA
Day 7–10
Analysis & severity scoring
Day 11–13
Draft report & internal QA
Day 14–15
Live walkthrough & backlog handoff

ComplyMynt risk dashboard showing tracked findings and remediation progress over time

Questions

About the report itself

Get the full 40-page sample report

Sent within one business day, under NDA if you prefer. No sales sequence attached.

Request the full PDF See pricing