A finding is a signal that requires attention. This could be a vulnerability, but also an incorrect setting, missing security measures or deviation from policy.
A finding is not always immediately an incident. It is primarily a reason to assess what it means and what follow-up is needed.
Also read How does OpenKAT help with prioritization?.