Tracking the severity of findings and measuring risks