I would recommend the following information be included in a security code review:
Vulnerability Overview - This should include a high level overview of what was the problem that was discovered. This may also include background information on the type of vulnerability.
Severity - Determine a scale such as High, Medium and Low or something that seems applicable to the software you are reviewing.
Vulnerability Details This should include specific details relating to the vulnerability as it pertains to the software you are testing. If you have access to to the code and you can document the function in question this would be the place to point that out.
Vulnerability Remediation This is where you suggest the solution to fix the vulnerability.
Replication Technique This may or may not be optional however you can include how the vulnerability was discovered or how it can be exploited with examples.
Of course I would include a high level summary of the entire report for the management team.