What is the difference between identifying a weakness, describing the risk and making a recommendation?
