A summary of the findings and their implications for the reader.
Which company rule or expectation was not met.
Description of the weakness identified (e.g., XSS, insecure permissions).
Detailed points and data that support your main argument.