claude-code-arcane 1.0.0

package/skills/snowflake-development/scripts/snowflake_query_helper.py

@@ -0,0 +1,233 @@
+#!/usr/bin/env python3
+"""
+Snowflake Query Helper
+
+Generate common Snowflake SQL patterns: MERGE upserts, Dynamic Table DDL,
+and RBAC grant statements. Outputs ready-to-use SQL that follows Snowflake
+best practices.
+
+Usage:
+    python snowflake_query_helper.py merge --target customers --source stg_customers --key id --columns name,email
+    python snowflake_query_helper.py dynamic-table --name cleaned_events --warehouse transform_wh --lag "5 minutes"
+    python snowflake_query_helper.py grant --role analyst --database analytics --schemas public --privileges SELECT,USAGE
+    python snowflake_query_helper.py merge --target t --source s --key id --columns a,b --json
+"""
+
+import argparse
+import json
+import sys
+import textwrap
+from typing import List, Optional
+
+
+def generate_merge(
+    target: str,
+    source: str,
+    key: str,
+    columns: List[str],
+    schema: Optional[str] = None,
+) -> str:
+    """Generate a MERGE (upsert) statement following Snowflake best practices."""
+    prefix = f"{schema}." if schema else ""
+    t = f"{prefix}{target}"
+    s = f"{prefix}{source}"
+
+    # Filter out updated_at from user columns to avoid duplicates
+    merge_cols = [col for col in columns if col != "updated_at"]
+
+    update_sets = ",\n        ".join(
+        f"t.{col} = s.{col}" for col in merge_cols
+    )
+    update_sets += ",\n        t.updated_at = CURRENT_TIMESTAMP()"
+
+    insert_cols = ", ".join([key] + merge_cols + ["updated_at"])
+    insert_vals = ", ".join(
+        [f"s.{key}"] + [f"s.{col}" for col in merge_cols] + ["CURRENT_TIMESTAMP()"]
+    )
+
+    return textwrap.dedent(f"""\
+        MERGE INTO {t} t
+        USING {s} s
+            ON t.{key} = s.{key}
+        WHEN MATCHED THEN
+            UPDATE SET
+                {update_sets}
+        WHEN NOT MATCHED THEN
+            INSERT ({insert_cols})
+            VALUES ({insert_vals});""")
+
+
+def generate_dynamic_table(
+    name: str,
+    warehouse: str,
+    lag: str,
+    source: Optional[str] = None,
+    columns: Optional[List[str]] = None,
+    schema: Optional[str] = None,
+) -> str:
+    """Generate a Dynamic Table DDL with best-practice defaults."""
+    prefix = f"{schema}." if schema else ""
+    full_name = f"{prefix}{name}"
+    src = source or "<source_table>"
+    col_list = ", ".join(columns) if columns else "<col1>, <col2>, <col3>"
+
+    return textwrap.dedent(f"""\
+        CREATE OR REPLACE DYNAMIC TABLE {full_name}
+            TARGET_LAG = '{lag}'
+            WAREHOUSE = {warehouse}
+            AS
+            SELECT {col_list}
+            FROM {src}
+            WHERE 1=1;  -- Add your filter conditions
+
+        -- Verify refresh mode (incremental is preferred):
+        -- SELECT name, refresh_mode, refresh_mode_reason
+        -- FROM TABLE(INFORMATION_SCHEMA.DYNAMIC_TABLES())
+        -- WHERE name = '{name.upper()}';""")
+
+
+def generate_grants(
+    role: str,
+    database: str,
+    schemas: List[str],
+    privileges: List[str],
+) -> str:
+    """Generate RBAC grant statements following least-privilege principles."""
+    lines = [f"-- RBAC grants for role: {role}"]
+    lines.append(f"-- Generated following least-privilege principles")
+    lines.append("")
+
+    # Database-level
+    lines.append(f"GRANT USAGE ON DATABASE {database} TO ROLE {role};")
+    lines.append("")
+
+    for schema in schemas:
+        fq_schema = f"{database}.{schema}"
+        lines.append(f"-- Schema: {fq_schema}")
+        lines.append(f"GRANT USAGE ON SCHEMA {fq_schema} TO ROLE {role};")
+
+        for priv in privileges:
+            p = priv.strip().upper()
+            if p == "USAGE":
+                continue  # Already granted above
+            elif p == "SELECT":
+                lines.append(
+                    f"GRANT SELECT ON ALL TABLES IN SCHEMA {fq_schema} TO ROLE {role};"
+                )
+                lines.append(
+                    f"GRANT SELECT ON FUTURE TABLES IN SCHEMA {fq_schema} TO ROLE {role};"
+                )
+                lines.append(
+                    f"GRANT SELECT ON ALL VIEWS IN SCHEMA {fq_schema} TO ROLE {role};"
+                )
+                lines.append(
+                    f"GRANT SELECT ON FUTURE VIEWS IN SCHEMA {fq_schema} TO ROLE {role};"
+                )
+            elif p in ("INSERT", "UPDATE", "DELETE", "TRUNCATE"):
+                lines.append(
+                    f"GRANT {p} ON ALL TABLES IN SCHEMA {fq_schema} TO ROLE {role};"
+                )
+                lines.append(
+                    f"GRANT {p} ON FUTURE TABLES IN SCHEMA {fq_schema} TO ROLE {role};"
+                )
+            elif p == "CREATE TABLE":
+                lines.append(
+                    f"GRANT CREATE TABLE ON SCHEMA {fq_schema} TO ROLE {role};"
+                )
+            elif p == "CREATE VIEW":
+                lines.append(
+                    f"GRANT CREATE VIEW ON SCHEMA {fq_schema} TO ROLE {role};"
+                )
+            else:
+                lines.append(
+                    f"GRANT {p} ON SCHEMA {fq_schema} TO ROLE {role};"
+                )
+        lines.append("")
+
+    return "\n".join(lines)
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Generate common Snowflake SQL patterns",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog=textwrap.dedent("""\
+            Examples:
+              %(prog)s merge --target customers --source stg --key id --columns name,email
+              %(prog)s dynamic-table --name clean_events --warehouse wh --lag "5 min"
+              %(prog)s grant --role analyst --database db --schemas public --privileges SELECT
+        """),
+    )
+    parser.add_argument(
+        "--json", action="store_true", help="Output as JSON instead of raw SQL"
+    )
+
+    subparsers = parser.add_subparsers(dest="command", help="SQL pattern to generate")
+
+    # MERGE subcommand
+    merge_p = subparsers.add_parser("merge", help="Generate MERGE (upsert) statement")
+    merge_p.add_argument("--target", required=True, help="Target table name")
+    merge_p.add_argument("--source", required=True, help="Source table name")
+    merge_p.add_argument("--key", required=True, help="Join key column")
+    merge_p.add_argument(
+        "--columns", required=True, help="Comma-separated columns to merge"
+    )
+    merge_p.add_argument("--schema", help="Schema prefix (e.g., my_db.my_schema)")
+
+    # Dynamic Table subcommand
+    dt_p = subparsers.add_parser(
+        "dynamic-table", help="Generate Dynamic Table DDL"
+    )
+    dt_p.add_argument("--name", required=True, help="Dynamic Table name")
+    dt_p.add_argument("--warehouse", required=True, help="Warehouse for refresh")
+    dt_p.add_argument(
+        "--lag", required=True, help="Target lag (e.g., '5 minutes', '1 hour')"
+    )
+    dt_p.add_argument("--source", help="Source table name")
+    dt_p.add_argument("--columns", help="Comma-separated column list")
+    dt_p.add_argument("--schema", help="Schema prefix")
+
+    # Grant subcommand
+    grant_p = subparsers.add_parser("grant", help="Generate RBAC grant statements")
+    grant_p.add_argument("--role", required=True, help="Role to grant to")
+    grant_p.add_argument("--database", required=True, help="Database name")
+    grant_p.add_argument(
+        "--schemas", required=True, help="Comma-separated schema names"
+    )
+    grant_p.add_argument(
+        "--privileges",
+        required=True,
+        help="Comma-separated privileges (SELECT, INSERT, UPDATE, DELETE, CREATE TABLE, etc.)",
+    )
+
+    args = parser.parse_args()
+
+    if not args.command:
+        parser.print_help()
+        sys.exit(1)
+
+    if args.command == "merge":
+        cols = [c.strip() for c in args.columns.split(",")]
+        sql = generate_merge(args.target, args.source, args.key, cols, args.schema)
+    elif args.command == "dynamic-table":
+        cols = [c.strip() for c in args.columns.split(",")] if args.columns else None
+        sql = generate_dynamic_table(
+            args.name, args.warehouse, args.lag, args.source, cols, args.schema
+        )
+    elif args.command == "grant":
+        schemas = [s.strip() for s in args.schemas.split(",")]
+        privs = [p.strip() for p in args.privileges.split(",")]
+        sql = generate_grants(args.role, args.database, schemas, privs)
+    else:
+        parser.print_help()
+        sys.exit(1)
+
+    if args.json:
+        output = {"command": args.command, "sql": sql}
+        print(json.dumps(output, indent=2))
+    else:
+        print(sql)
+
+
+if __name__ == "__main__":
+    main()

package/skills/soc2-compliance/SKILL.md

@@ -0,0 +1,132 @@
+---
+name: soc2-compliance
+description: "SOC 2 Type I and Type II compliance — Trust Service Criteria mapping, control matrices, gap analysis, evidence collection, and audit readiness."
+argument-hint: ""
+category: "regulatory"
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash
+---
+# SOC 2 Compliance
+
+SOC 2 Type I and Type II compliance preparation for SaaS companies.
+
+## Overview
+
+### Type I vs Type II
+
+| Aspect | Type I | Type II |
+|--------|--------|---------|
+| Scope | Design at a point in time | Design AND effectiveness over a period |
+| Duration | Snapshot | 3-12 months observation |
+| Cost | $20K-$50K | $30K-$100K+ |
+| Best For | First-time compliance | Mature organizations, enterprise |
+
+### Typical Journey
+
+```
+Gap Assessment → Remediation → Type I → Observation Period → Type II → Annual Renewal
+    (4-8 wk)      (8-16 wk)   (4-6 wk)    (6-12 mo)       (4-6 wk)    (ongoing)
+```
+
+---
+
+## Trust Service Criteria
+
+**Security (CC1-CC9)** is required for every SOC 2 report. Optional categories:
+
+| Category | When to Select |
+|----------|---------------|
+| **Availability (A1)** | Customers depend on uptime; you have SLAs |
+| **Confidentiality (C1)** | Trade secrets, proprietary, contractually confidential data |
+| **Processing Integrity (PI1)** | Data accuracy critical (financial, healthcare, analytics) |
+| **Privacy (P1-P8)** | Process PII and customers expect privacy assurance |
+
+For complete TSC sub-criteria, control objectives, and evidence examples, see [references/trust_service_criteria.md](references/trust_service_criteria.md).
+
+---
+
+## Control Matrix Generation
+
+Map each TSC criterion to specific controls, owners, evidence, and testing procedures.
+
+1. Select applicable TSC categories
+2. Run `control_matrix_builder.py` to generate baseline matrix
+3. Customize controls to match your environment
+4. Assign owners and evidence requirements
+5. Validate coverage — every selected criterion must have at least one control
+
+For control naming convention and matrix structure, see [references/trust_service_criteria.md](references/trust_service_criteria.md).
+
+---
+
+## Gap Analysis Workflow
+
+1. **Current State** — Document existing controls, map to TSC, collect evidence samples
+2. **Gap Identification** — Run `gap_analyzer.py` to find missing, partial, design, or operating gaps
+3. **Remediation Planning** — Define actions, owners, priorities, target dates per gap
+4. **Timeline** — Critical: 2-4 wk, High: 4-8 wk, Medium: 8-12 wk, Low: 12-16 wk
+
+---
+
+## Evidence Collection
+
+| Control Area | Primary Evidence |
+|--------------|-----------------|
+| Access Management | User access reviews, provisioning tickets |
+| Change Management | Change tickets, approval records |
+| Incident Response | Incident tickets, postmortems |
+| Vulnerability Mgmt | Scan reports, patch records |
+| Encryption | Configuration screenshots, certificate inventory |
+| Backup & Recovery | Backup logs, DR test results |
+
+For automation opportunities and continuous monitoring guidance, see [references/evidence_collection_guide.md](references/evidence_collection_guide.md).
+
+---
+
+## Audit Readiness Checklist
+
+- [ ] All controls documented with descriptions, owners, frequencies
+- [ ] Evidence collected for entire observation period (Type II)
+- [ ] Policies signed and distributed within last 12 months
+- [ ] Access reviews completed within required frequency
+- [ ] Vulnerability scans current (no critical/high unpatched > SLA)
+- [ ] Incident response plan tested within last 12 months
+- [ ] Vendor risk assessments current
+- [ ] DR/BCP tested and documented within last 12 months
+
+| Score | Rating |
+|-------|--------|
+| 90-100% | Audit Ready |
+| 75-89% | Minor Gaps — address before audit |
+| 50-74% | Significant Gaps — remediation required |
+| <50% | Not Ready |
+
+---
+
+## Vendor Management
+
+Every vendor accessing customer data must be assessed. For vendor risk tiers, subservice organization handling, and assessment requirements, see [references/evidence_collection_guide.md](references/evidence_collection_guide.md).
+
+---
+
+## Tools and References
+
+```bash
+python scripts/control_matrix_builder.py --categories security --format md
+python scripts/evidence_tracker.py --matrix controls.json --status
+python scripts/gap_analyzer.py --controls current_controls.json --type type1
+```
+
+| Document | Content |
+|----------|---------|
+| [trust_service_criteria.md](references/trust_service_criteria.md) | All 5 TSC categories with sub-criteria and evidence |
+| [evidence_collection_guide.md](references/evidence_collection_guide.md) | Evidence types, automation, vendor management |
+| [type1_vs_type2.md](references/type1_vs_type2.md) | Detailed comparison, timeline, cost, upgrade path |
+
+---
+
+## Cross-References
+
+- **gdpr-dsgvo-expert** — SOC 2 Privacy criteria overlaps with GDPR
+- **information-security-manager-iso27001** — ISO 27001 Annex A maps to SOC 2 Security
+- **isms-audit-expert** — Audit methodology transfers to SOC 2 preparation

package/skills/soc2-compliance/references/evidence_collection_guide.md

@@ -0,0 +1,227 @@
+# SOC 2 Evidence Collection Guide
+
+Practical guide for collecting, organizing, and maintaining audit evidence for SOC 2 Type I and Type II engagements. Covers evidence types, automation strategies, and documentation requirements.
+
+---
+
+## Evidence Fundamentals
+
+### What Auditors Look For
+
+1. **Existence** — The control is documented and exists
+2. **Design effectiveness** — The control is designed to address the TSC criterion (Type I + Type II)
+3. **Operating effectiveness** — The control operates consistently over the observation period (Type II only)
+
+### Evidence Quality Criteria
+
+| Criterion | Description |
+|-----------|-------------|
+| **Relevant** | Directly demonstrates the control's operation |
+| **Reliable** | Generated by systems or independent parties (not self-reported) |
+| **Timely** | Falls within the audit/observation period |
+| **Sufficient** | Enough samples to demonstrate consistency |
+| **Complete** | Covers the full population or a representative sample |
+
+### Evidence Types
+
+| Type | Description | Examples |
+|------|-------------|---------|
+| **Inquiry** | Verbal or written descriptions from personnel | Interview notes, written responses |
+| **Observation** | Auditor witnesses control in operation | Process walkthroughs, live demonstrations |
+| **Inspection** | Review of documents, records, or configurations | Policy documents, system screenshots, logs |
+| **Re-performance** | Auditor re-executes the control to verify results | Access review validation, configuration checks |
+
+---
+
+## Evidence by Control Area
+
+### Access Management
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| Access provisioning | Provisioning policy, role matrix | Sample provisioning tickets with approvals (full period) |
+| Access removal | Termination checklist, deprovisioning SOP | Sample termination events with access removal timestamps |
+| Access reviews | Review policy, review template | Completed quarterly access review reports with sign-offs |
+| MFA enforcement | MFA policy, configuration screenshot | MFA enrollment report showing 100% coverage |
+| Privileged access | Privileged access policy, admin list | Quarterly privileged access reviews, admin activity logs |
+
+### Change Management
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| Change authorization | Change management policy, workflow description | Sample change tickets with approvals, peer reviews |
+| Testing requirements | Testing policy, test plan template | Test results for sampled changes, QA sign-offs |
+| Emergency changes | Emergency change procedure | Emergency change tickets with post-hoc approvals |
+| Deployment process | CI/CD documentation, deployment runbook | Deployment logs, rollback records |
+| Code review | Code review policy | Pull request histories showing reviewer approvals |
+
+### Incident Response
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| IR plan | Incident response plan document | Plan review/update records, version history |
+| IR testing | Tabletop exercise schedule | Tabletop exercise reports, lessons learned |
+| Incident handling | Triage procedures, classification criteria | Incident tickets with timestamps, escalation records |
+| Postmortems | Postmortem template, review process | Completed postmortem documents, follow-up actions |
+| Communication | Communication plan, stakeholder list | Notification records, status page updates |
+
+### Vulnerability Management
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| Scanning | Scanning schedule, tool configuration | Scan reports covering the full period (weekly/monthly) |
+| Remediation SLAs | Remediation policy with SLA definitions | Remediation tracking showing SLA compliance rates |
+| Patch management | Patching policy, schedule | Patch records, before/after scan comparisons |
+| Penetration testing | Pentest policy, scope definition | Pentest reports (annual), remediation records |
+
+### Encryption and Data Protection
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| Encryption at rest | Encryption policy, configuration docs | Configuration screenshots, encryption audit reports |
+| Encryption in transit | TLS policy, minimum version requirements | TLS scan results, certificate inventory |
+| Key management | Key management policy, rotation schedule | Key rotation logs, access records for key stores |
+| DLP | DLP policy, tool configuration | DLP alert logs, incident records, exception approvals |
+
+### Backup and Recovery
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| Backup procedures | Backup policy, schedule, retention rules | Backup success/failure logs (daily), retention compliance |
+| DR planning | DR plan, recovery procedures | DR plan review records, update history |
+| DR testing | DR test schedule, test plan | DR test reports with RTO/RPO measurements |
+| BCP | BCP document, communication tree | BCP review records, test results |
+
+### Monitoring and Logging
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| SIEM/logging | Logging policy, SIEM configuration | Log retention evidence, alert samples, dashboard screenshots |
+| Alert management | Alert rules, escalation procedures | Alert trigger samples, response records |
+| Uptime monitoring | Monitoring tool configuration, SLA definitions | Uptime reports covering the full period |
+| Anomaly detection | Detection rules, baseline configuration | Detection events, investigation records |
+
+### Policy and Governance
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| Security policies | Policy library, version control | Policy acknowledgment records, annual review evidence |
+| Security training | Training program description, content | Training completion records (all employees) |
+| Risk assessment | Risk assessment methodology | Annual risk assessment report, risk register updates |
+| Board oversight | Committee charter, reporting schedule | Board meeting minutes, security reports to leadership |
+
+### Vendor Management
+
+| Control | Type I Evidence | Type II Evidence |
+|---------|----------------|-----------------|
+| Vendor inventory | Vendor register, classification criteria | Current vendor register with risk tiers |
+| Vendor assessment | Assessment questionnaire, criteria | Completed assessments, vendor SOC reports collected |
+| Contractual controls | DPA template, security requirements | Signed DPAs, contract review records |
+| Ongoing monitoring | Monitoring schedule, reassessment triggers | Reassessment records, monitoring reports |
+
+---
+
+## Evidence Automation
+
+### Automated Evidence Sources
+
+| Evidence | Automation Approach | Tools |
+|----------|-------------------|-------|
+| Access reviews | Scheduled IAM exports, automated review workflows | Okta, Azure AD, AWS IAM + Jira/ServiceNow |
+| Configuration compliance | Infrastructure-as-code, policy-as-code scanning | Terraform, OPA, AWS Config, Azure Policy |
+| Vulnerability scans | Scheduled scanning with report auto-generation | Nessus, Qualys, Snyk, Dependabot |
+| Change management | Git-based audit trails (commits, PRs, approvals) | GitHub, GitLab, Bitbucket |
+| Uptime monitoring | Continuous synthetic monitoring with SLA dashboards | Datadog, New Relic, PagerDuty, Pingdom |
+| Backup verification | Automated backup validation and restore tests | AWS Backup, Veeam, custom scripts |
+| Training completion | LMS with automated tracking and reminders | KnowBe4, Curricula, custom LMS |
+| Policy acknowledgment | Digital signature workflows with tracking | DocuSign, HelloSign, internal tools |
+
+### Evidence Collection Script Pattern
+
+```
+1. Define evidence requirements per control
+2. Map each requirement to a data source (API, log, screenshot)
+3. Schedule automated collection (daily/weekly/monthly)
+4. Store evidence with timestamps in a central repository
+5. Generate collection status dashboard
+6. Alert on missing or overdue evidence
+```
+
+### Evidence Repository Structure
+
+```
+evidence/
+├── {year}-{audit-period}/
+│   ├── access-management/
+│   │   ├── quarterly-access-review-Q1.pdf
+│   │   ├── quarterly-access-review-Q2.pdf
+│   │   ├── mfa-enrollment-report-2025-03.png
+│   │   └── provisioning-samples/
+│   ├── change-management/
+│   │   ├── change-ticket-samples/
+│   │   └── deployment-logs/
+│   ├── incident-response/
+│   │   ├── ir-plan-v3.2.pdf
+│   │   ├── tabletop-exercise-2025-06.pdf
+│   │   └── incident-tickets/
+│   ├── vulnerability-management/
+│   │   ├── scan-reports/
+│   │   └── pentest-report-2025.pdf
+│   ├── policies/
+│   │   ├── information-security-policy-v4.pdf
+│   │   └── acknowledgment-records/
+│   └── vendor-management/
+│       ├── vendor-register.csv
+│       └── vendor-assessments/
+```
+
+---
+
+## Sampling Methodology
+
+Auditors use sampling to test operating effectiveness. Understanding the methodology helps you prepare the right volume of evidence.
+
+### Sample Sizes by Control Frequency
+
+| Control Frequency | Population Size (per period) | Typical Sample Size |
+|-------------------|------------------------------|-------------------|
+| Annual | 1 | 1 (all items) |
+| Quarterly | 4 | 2-4 |
+| Monthly | 6-12 | 2-5 |
+| Weekly | 26-52 | 5-15 |
+| Daily | 180-365 | 20-40 |
+| Continuous/per-event | Varies | 25-60 |
+
+### Key Sampling Rules
+
+1. **Higher frequency = larger sample** — more occurrences mean more samples needed
+2. **Automated controls** — typically only 1 sample needed if the system is validated
+3. **Exceptions must be explained** — any deviation in a sample requires documentation
+4. **Population completeness** — you must provide the full population for the auditor to select from
+
+---
+
+## Type I vs Type II Evidence Differences
+
+| Aspect | Type I | Type II |
+|--------|--------|---------|
+| **Time scope** | Single point in time | Entire observation period (3-12 months) |
+| **Volume** | Lower — policies and configurations | Higher — ongoing logs, tickets, reports |
+| **Focus** | "Is the control designed properly?" | "Did the control operate effectively?" |
+| **Exceptions** | N/A | Must document and explain every exception |
+| **Owner sign-off** | Policy approval records | Ongoing review sign-offs throughout the period |
+
+---
+
+## Common Evidence Pitfalls
+
+| Pitfall | Impact | Prevention |
+|---------|--------|-----------|
+| Screenshots without timestamps | Auditor cannot verify timing | Always include system clock or date stamps |
+| Policies without version control | Cannot prove current vs outdated | Use document management with version tracking |
+| Access reviews without sign-off | Cannot prove review was completed | Require digital approval/sign-off on every review |
+| Gaps in monitoring data | Suggests control was not operating | Ensure logging continuity; document any outages |
+| Evidence from wrong period | Does not cover the observation window | Verify date ranges before submission |
+| Redacted evidence without explanation | Auditor may question completeness | Provide redaction rationale and methodology |
+| Self-generated evidence only | Lower reliability in auditor's assessment | Include system-generated and third-party evidence |
+| Missing exception documentation | Auditor flags as control failure | Document every exception with root cause and remediation |