Every document carries its own version history. A signature points at the exact wording that was signed, so it can still be produced in five years.

Scored on a fixed 5×5 matrix: likelihood by consequence, 1 to 25. Scored twice - as it stands, and again after the controls, because that difference is the only evidence a control did anything.

Anybody can report one - the person who saw it is usually standing there. Investigating and closing is the office, and an incident cannot be closed while a corrective action is still open.