Changing the Report Template Mid-Engagement Without Losing Work

You can change an engagement’s report template partway through without losing anything, provided you decide where everything already written will go before you switch, not after. For each field the new template does not have, move its text into one it does or keep it aside; write any field the new template needs before review; and rename the severity levels rather than re-rating the findings. Done in that order, the change takes minutes. Done the other way round, it takes a day of hunting for text that has gone missing.

Why it happens

A change of template mid-engagement is rarely anyone’s mistake. The common causes:

• The client asks for their own format. Procurement or an internal audit team wants every supplier’s findings in one layout, and the request arrives after testing has started.
• The work becomes a partner’s. A test you started under your own name is to go out under another consultancy’s, in their template; writing white-label pentest reports in a partner’s template covers that side of it.
• The engagement was set up on the wrong one. An infrastructure test booked on the web application template, noticed when the first finding has nowhere to put its host and port.
• The scope changed. A web test that grew to include the cloud account behind it may need the cloud template’s sections.

First, check it really is a template change

Some requests that sound like a new template are not. A different logo and company name, a different cover page, or a different name for one severity level can often be met on the template you have. A template change is about structure: which fields a finding carries, which sections the report has, and in what order. If the request is only about appearance, change the appearance and leave the findings alone.

Map what is written before you switch

Put the two templates side by side and list the fields of a finding and the sections of the report in each. Everything falls into one of four groups:

In the old template	In the new one	What to do
Yes	Yes, same name	Nothing
Yes	Yes, another name	Nothing to move; check the text reads well under its new heading
Yes	No	Move its text into a field the new template has, or keep it aside
No	Yes	Write it, on every finding that needs it, before review

The third row is where work gets lost. A business impact field the new template does not print usually belongs at the end of the description; a references field may belong under the remediation, or nowhere. Decide per field, not per finding, so every finding is treated the same way. Text that has no home in the new template should be kept on the finding rather than deleted: the client may ask for the original format back, and the engagement may yet move again.

Moving words into a rich text field is safe. Moving a choice, a score or an attachment into a text field usually is not, because it loses its meaning on the way; keep those aside instead.

Severity names are not ratings

Two templates often call the same five levels by different names: Informational becomes Note, or Critical is not used at all. Rename, do not re-rate. A finding rated High on the evidence is still High under the new template, whatever that template calls the level. If the new template has no Critical and a finding scores 9.0 or more in CVSS, agree with the client or partner how it is reported rather than quietly lowering it; penetration testing severity levels covers how scales differ.

Required fields and review

A field the new template prints on every finding is empty on every finding until somebody writes it. Write those before the report goes to review, not during it: a reviewer reading a report with forty empty business impact sections reviews nothing useful, and the tester who understood each finding is the right person to write its impact. Switching before QA starts, rather than after approval, also means the reviewer reads the report the client will receive, under the headings the client will see. A QA process for reports that survives a busy month covers the review itself.

Read the result before anyone else does

Once the switch is made, produce the report in the new template from every finding, not only the first few, and read it as the client will. Look for headings with nothing under them, text that moved into another field and now repeats what was already there, and summary tables or charts that still use the old names for the severity levels. Words moved from one field into another read better with the old field’s name as a lead-in, so that a paragraph of business impact at the end of a description still says what it is.

Tell the client what changes

If drafts or live findings have already been shared, say what will look different: section names, the order of the report, perhaps the names of the severity levels. A client who sees Note where Informational used to be, with no warning, may assume a finding was downgraded. One line in the next update avoids the question. Handing an engagement over mid-test covers the related case where it is the tester, not the template, that changes partway through.