ACP-6 Deficiencies

Any control exception found while answering an auditor is reported to the CISO the same day; records are given to auditors exactly as held.

The SPECIMEN organisation's own procedure (in the scenario inputs, access-control-procedure.md); no external clause decides this step.