PramodDutta Prepare QA Audit Handoff
Package approved QA records around the auditor's explicit request. Report what is available and missing while leaving compliance conclusions to authorized reviewers.
Workflow
- Freeze the handoff ID and version, audit request reference and revision, review period, product and release scope, intended recipient, data boundary, and as-of time with timezone.
- Inventory only approved deliverables and evidence manifests. Record source version, custodian, approval state, access classification, and current availability.
- Map each supplied request or control ID to evidence and deliverable IDs with a concise, source-based rationale. Mark unsupported mappings unfulfilled or unverified.
- Verify supplied access, retention, legal-hold, confidentiality, redaction, and recipient-authorization records. Do not invent policy terms or grant access.
- Prepare the handoff index, chain-of-custody log, access expiry, recipient questions, and gaps or exceptions. Keep compliance conclusion not assessed.
- HUMAN REVIEW GATE: require the audit liaison, evidence custodian, data owner, and any required compliance reviewer to approve content, redactions, recipients, and transfer.
Output Contract
Return these fields:
- Handoff ID and version; audit request ID and revision; review period; product and release scope; intended recipient; data boundary; as-of timestamp and timezone.
- Source inventory table: Source ID | Type | URI or path | Version | Approval state | Custodian | Access classification | Availability.
- Request mapping table: Request or control ID | Supplied text and source revision | Deliverable and evidence IDs | Mapping rationale | Custodian | Fulfillment state.
- Gaps and exceptions table: Request or control ID | Missing item | Evidence of gap | Impact | Stated owner | Due date if stated.
- Chain-of-custody log: Artifact or bundle ID | From | To | Transfer method | Timestamp | Receipt evidence | State.
- Access and retention table: Artifact or bundle ID | Authorized recipients | Access path | Access expiry | Retention source and period | Legal-hold state.
- Recipient questions and pending acknowledgments.
- Redaction register: item | data class | display treatment | authorization | original preserved.
- Compliance conclusion: not assessed.
- HUMAN REVIEW GATE: audit liaison | custodian | data owner | compliance reviewer | sign-off status | transfer and publication status.
Scope Boundary
- Map an explicit audit request to already approved deliverables and curated evidence; do not create test evidence, assess coverage, write a closure report, or decide release.
- Organize a handoff; do not interpret law, invent controls, certify compliance, grant access, or transmit artifacts.
Guardrails
- Never invent request text, controls, mappings, evidence, custodians, approvals, timestamps, retention terms, access rights, receipts, or compliance conclusions.
- Treat no response, inaccessible evidence, or an absent artifact as a gap, never proof of compliance.
- Redact secrets and personal data from displayed working copies, record the treatment, preserve originals, and honor the supplied data boundary.
- Do not publish, send, upload, grant access, approve the handoff, or sign for another person without explicit human authorization after the review gate.