The severe-event final report has a different clock from the flaw report. It is due within one month after the 72-hour event notice was filed.

Base the due date on proof of that filing. Save the exact data, time, filing person, reader, and result. Do not work it out later from the time on an in-house draft.

Open the final-report work at filing

When the 72-hour notice is filed, open the final-report task from that event. Record the due date, owner, review dates, open proof points, and fix owners. Do not wait for the whole fact review to feel done before someone owns the final report.

Keep the outside filing time apart from draft, approval, and failed-send times. If proof of filing is in doubt, raise it at once. The final clock turns on that event.

Move from initial to detailed assessment

The final report gives a full account of the event, its level, and its harm. It names the type of threat or likely cause. It also lists fixes in place and still under way. Build each part from named proof. Mark open points as open.

Do not state more trust in the cause than the facts support. Keep a known cause apart from the best current idea and a cause ruled out. Link each result to its proof and approver.

Build product scope again from the proof. Do not just copy the 72-hour value. Mark versions as kept, removed, added, or not yet clear. Explain large changes. Do the same for harm, threat, level, and fixes.

Keep a change log. Each row should show the old claim, final claim, reason, proof, and approver. A small name fix should not look like a major change in result.

Preserve continuing work

“Final report” does not mean that every fix is done. The report can include work still under way. Record its owner, scope, state, and proof needed at the end.

Before filing, compare product IDs, awareness time, event level, and fixes with the early reports. Explain large changes in the final account. Do not make the reader find them by chance.

For each open fix, state what is in place and what is only planned. Name the owner, products at issue, and proof of completion. A ready report does not mean the response is done.

Keep the draft, approved copy, and filed copy apart. A read-only peer should be able to trace the one-month clock and the growth of the review. The peer should also see the state of every fix without opening the live case area.

Continue this workflow with the 72-hour incident packet and the stage-handoff record.