Map each provider's labels and reason codes to your own risk categories — versioned, reviewable, and with the original findings kept for audit.