---
sourceDocument: Australia Impact
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/impact

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Impact

ft:clusterId :

    - ipact

bundleId :

    - ipact


---

# Understand scan results and findings

# Understand scan results and findings {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Understand scan results and findings

After running a Scan Engine scan in your ServiceNow instance, you can monitor its real-time progress and review completed scan results to identify and resolve issues.
This process involves two key steps: viewing scan results to track scan status and batches, and working with individual findings to understand their enforcement level and impact before applying fixes or submitting exceptions.
Show full answer Show less  

## How Findings Are Evaluated

Each finding is assessed based on two critical dimensions to help prioritize remediation and maintain compliance:

* **Enforcement Level:** Defines system behavior and enforcement action. Levels include **ACT** (block action), **RECOMMEND** (requires approval for exceptions), **SUGGEST** (recommendations without blocking), and **REVIEW** (informational only).
* **Impact to Instance (Risk Rating):** Rates the business and technical risk of leaving the finding unresolved on a scale from 1 (minimal) to 10 (critical) within each enforcement level.

The enforcement level dictates required actions and whether exceptions are allowed, while the impact rating prioritizes the order of remediation within each level. Enforcement level always takes precedence over impact rating.

## Enforcement Levels and Actions

* **ACT:** Critical issues blocking save until fixed; no exceptions allowed; override requires admin rights.
* **RECOMMEND:** High severity issues blocking save until fixed or an approved exception is submitted.
* **SUGGEST:** Moderate issues prompting improvements; do not block progress; can be excluded from messages.
* **REVIEW:** Low impact informational findings; no blocking; monitor and optionally fix.

## Practical Examples

* An ACT level finding with impact 9 requires immediate fix before proceeding with no exceptions.
* A SUGGEST level finding with impact 8 signals high risk but does not block development and should be prioritized accordingly.

## Working with Finding Records

Finding records provide detailed context and tracking information to facilitate issue resolution:

* **Key fields include:** Application scope, description, category (e.g., Security, Performance), finding counts, impact severity, estimated remediation time, and fix status.
* **Additional context fields:** Direct links to the scanned record, creator/modifier information, exception reasons (for RECOMMEND level), assigned groups, assignment source details, and embedded remediation guidance.

This information helps teams quickly understand the nature of issues, assign responsibilities, track remediation progress, and provide justifications for exceptions when applicable.

## Benefits for ServiceNow Customers

By understanding scan results and findings, your team can:

* Prioritize and address critical issues that impact functionality, security, and compliance.
* Manage enforcement actions effectively with clear guidance on when exceptions are allowed.
* Gain transparency and accountability through detailed finding records and assignment tracking.
* Maintain development velocity by balancing mandatory fixes with suggested improvements.  
After a scan runs, you can monitor its progress in real-time, review the completed results, and then work with the findings to resolve issues in your instance.

Reviewing scan results and acting on findings is a two-phase process.

1. View scan results: Monitor an active scan or open a completed scan record to see its status, duration, and batch progress. See [View scan results for Scan Engine](https://www.servicenow.com/docs/igA7dvkRF2fOyKPBB2PuWQ "You can view scans in real-time as they run or after they're completed. ").
2. Work with findings: Open individual findings from the scan record to understand their enforcement level and impact, then apply fixes or submit exceptions for review. See [Use Real-time prevention monitoring while coding](https://www.servicenow.com/docs/2u12Mrp4pctDa9dzpV15hw "As you write and save code, the Scan Engine detects violations in real-time and displays findings inline. You can then generate an AI-suggested fix before committing your changes.").

{#understand-scan-engine-results-findings__ol_scan_results_findings_flow}

## How findings are evaluated {#understand-scan-engine-results-findings__section_enforcement_overview}

Every finding in your instance is evaluated along two critical dimensions to help your team prioritize remediation efforts and maintain compliance standards.

Level of finding (enforcement level)
:   The enforcement behavior is determined whether the system blocks an action, issues a warning, or provides informational guidance. Enforcement levels are ACT, RECOMMEND, SUGGEST, and REVIEW. The enforcement level determines the
    action the system will take and whether exceptions are available.

Impact to instance (risk rating)
:   The business and technical risk of leaving the finding unresolved, rated from 1 (minimal) to 10 (critical) within each enforcement level. Higher values indicate findings that should be addressed first within that level.
:   Impact ratings operate independently within each enforcement level and don't create a global 1--10 scale across all levels.

These two dimensions work together, enforcement level determines what action is required, while impact rating determines the order in which findings should be addressed within that enforcement level.

## Enforcement levels and risk impact {#understand-scan-engine-results-findings__section_ks5_hbx_53c}

Depending on the level of the definition, users may be required to fix a finding before saving a record.
{#understand-scan-engine-results-findings__table_scan_findings__entry__4}

| Level of finding | Impact to instance (typical) | Severity description | Enforcement behavior / recommended action |
|:-:|:-:|:-|:-|
| ACT | 1--10 | Critical issues that can break functionality, cause security vulnerabilities, or block upgrades. | * The record can't be saved until the code is fixed to meet the requirements in the definition. * No exception reason option is available. * An override requires admin-level rights or the disabling of the definition. {#understand-scan-engine-results-findings__ul_nrp_q2k_ljc} |
| RECOMMEND | 1-10 | High severity issues that may degrade performance, stability, or security. Exceptions are allowed with approval. | * The record can't be saved until the issue is resolved or and exception reason is provided formal approval. * For more information, refer to [Submit exceptions for Scan Engine findings](https://www.servicenow.com/docs/Z74L4vWv_WqdxPMevS6QwA "Developers can submit exception requests for Suggest, Review, Recommend, and Act level findings if they determine the finding should not be considered an issue to deter development. The availability of each finding level depends on the exception reason scope configured by your system administrator."). {#understand-scan-engine-results-findings__ul_orp_q2k_ljc} |
| SUGGEST | 1-10 | Moderate issues, often related to optimization, maintainability, or best practices. | * Address during future development cycle * Does not block progress * Prompts to check for a better solution, if one is available. * Select whether to Exclude suggestion finding, which hides Suggestion level findings messages from displaying. {#understand-scan-engine-results-findings__ul_ebk_4dr_v3c} |
| REVIEW | 1-10 | Low impact, informational findings with minimal impact (i.e., unused fields or minor UI inconsistencies). | * Monitor and optionally fix during future development cycles. * Displays an informational message without blocking saves or creating finding records. |
[Table 1. Scan Engine finding levels, risk, and enforcement behavior]

{#understand-scan-engine-results-findings__table_scan_findings}  
Important:  
Impact rating applies independently to each enforcement level. An ACT 1 finding is always higher priority than a recommend 10 level finding, even though the numbers appear reversed.

Enforcement level takes precedence
over impact rating in prioritization. The 1--10 scale within each level allows granular severity differentiation while maintaining the enforcement hierarchy.

## Examples {#understand-scan-engine-results-findings__section_rkz_kcx_53c}

These two metrics work together to help teams balance enforcement and risk prioritization, ensuring critical issues are addressed first while maintaining development velocity.  
* ACT level finding with impact to instance of 9: Critical and must be fixed immediately before proceeding. No exceptions.
* SUGGEST level with impact to instance of 8: High-risk but does not block development. Should still be prioritized for remediation.
{#understand-scan-engine-results-findings__ul_dhz_lcx_53c}

## Finding record fields {#understand-scan-engine-results-findings__section_finding_record_fields}

When you open a finding record from a scan result, the record displays several key fields that provide context and tracking information about the finding.  
Note:  
To view the actual findings, navigate to ALL \> Impact \> Platform Health \> Open Findings.

{#understand-scan-engine-results-findings__table_open_findings_columns__entry__2}

| Column | Description |
|-|-|
| Application | The application scope containing the scanned record where the finding was detected. |
| Description | The scan definition violation that was detected. |
| Category | The category of the finding, such as Performance or Security. See [Customize Scan Engine definitions](https://www.servicenow.com/docs/ifyymSuokhJy~LFYMjjKGQ "You can modify an existing definition to further customize and refine its scanning criteria or deactivate a definition.") for details. |
| Finding counts | The number of times this finding was detected across scanned records in the application. |
| Impact to instance | A color-coded severity indicator showing the potential impact level. Higher numbers indicate greater severity. |
| Total technical debt (time) | The estimated time required to resolve the finding. |
| Fix status | The current remediation state of the finding. Values include Not requested, Not applicable, Ready for review, Reviewed, Revised, Processing, and Error. |
[Table 2. Open findings columns]

{#understand-scan-engine-results-findings__table_open_findings_columns} {#understand-scan-engine-results-findings__table_finding_fields__entry__2}

| Field | Description |
|-|-|
| Scanned Record URL/Application | * A direct link to the record in your instance that triggered this finding during the scan. * Select to navigate directly to the record and review the code, configuration, or content that generated the finding. * Essential for explaing the context of the issue. |
| Description | The description of the definition that triggered the finding |
| Introduced by | * The user, system process, or update set that created or last modified the record being scanned. * Use to track ownership and identify patterns in findings across your team. Helps with root-cause analysis and accountability. |
| Exception Reason | * When an exception is submitted for a RECOMMEND level finding, this field captures the business justification or context for the exception request. * Visible only when an exception is in progress or has been approved. Provides transparency to approvers and team members reviewing the exception. |
| Assigned group | * The team group to which the finding was automatically assigned when detected. Use to identify which team is responsible for remediating this finding. * The assigned group is set automatically at detection time by the assignment rule engine and cannot be changed by editing this field directly. |
| Assignment source | * Records which rule or fallback tier resolved the assignment for this finding, including the rule name and a timestamp. * Use to audit why a finding was routed to a specific group. The value identifies the Decision Table rule that fired, or the fallback tier that resolved the assignment when no rule matched. |
| Remediation guidance | * Embedded guidance delivered with the finding at the time of assignment, providing context-specific steps for the assigned team. * Review before starting remediation. The guidance is generated at detection time based on the finding type and assigned group, and may include references to team-specific resolution patterns. |
[Table 3. Key fields in a finding record]

{#understand-scan-engine-results-findings__table_finding_fields}
**Related tasks**   

* [View scan results for Scan Engine](https://www.servicenow.com/docs/igA7dvkRF2fOyKPBB2PuWQ "You can view scans in real-time as they run or after they're completed. ")  
**Related topics**   

* Automatic finding assignment in Scan Engine