Auditor packet

The Auditor packet is a single ZIP you can hand an external auditor — a point-in-time snapshot of the evidence they typically ask for, downloaded from Reports → Share with an auditor.

What's in it

• findings.csv — every finding (code, title, risk, status, the date its obligation applies from while that is still ahead, category, assessment, due date). A finding whose obligation has not started is not counted as open.
• policies.csv — your policies (type, version, status, effective/review dates).
• risk-register.csv — the risk register (likelihood, impact, score, treatment, status, due date).
• evidence/ — the actual evidence files plus a manifest.csv listing each one (only the current version of each file; superseded versions are skipped).
• README.txt — a cover sheet with the organization, the generated timestamp, who prepared it, and which sections are included.

Notes

• The packet is a point-in-time snapshot — the README timestamp is the "as of" date.
• Generating it requires an admin or auditor role (the same permission as any export), and it is rate-limited like every export: the packet has its own allowance, and a request beyond it is refused with a note to wait a few minutes.
• Like every export, the packet comes with a paid plan; it is not on the Free plan.
• If you ask for the AI cover narrative and it cannot be written, the README says why at the top: AI is off for your organization or plan, Watney is paused (until a date, or until we turn it back on for you), or a temporary fault (download the packet again).
• Evidence files are read only from your organization's evidence store; a file that can't be located is listed in the manifest as unavailable rather than silently dropped.