What the audit pack actually contains
Sponsors ask for a portal audit and picture a slide. We send a dated pack. This is what is inside, and what is not.
The pack has three parts. A short letter for the person who commissioned the work. A finding register with evidence, severity, and a suggested owner. A retest list so the next pass is not an argument about memory.
Severity is about customer harm and operational cost, not about how clever the issue looks. A broken password reset outranks a misaligned icon.
We do not include a redesign, a backlog in someone else’s tool, or a score out of 100. Scores make for easy comparisons and poor decisions. A register you can work through does not.
If a finding sits outside the engagement — hosting, a vendor you cannot change this quarter, a legal question — we label it as such. The pack should be usable on Monday morning, not impressive on Friday afternoon.