Spreadsheet Failure ModeManual Workflow
Root Operational Bottleneck
External-auditor PBC lists are rebuilt each cycle by copying screenshots into a binder, so the same control evidence is re-gathered instead of reused.
Control Hazard & Audit Exposure
Fieldwork extends while the PBC tracker shows items still outstanding that already existed as screenshots in last quarter's folder.
Deterministic Software ReplacementClient-Owned Architecture
Continuous Control Evidence Archive with External-Auditor PBC Portal
Continuous control-evidence archive that stores hashed artifacts per control and period and serves the PBC list from that archive, not a rebuilt binder.
Continuous Assertion Rule
PBC assertion: an external-auditor request cannot mark complete unless a hashed artifact for that control and period is attached, and missing periods stay on the open list.