The 'a regulation that applies was found before it was needed' test is not met and cannot be retro-fitted: the policy set found two obligations already live, the e-invoicing one by about nineteen months. The catalogue makes the test passable going forward; it does not make that instance a pass. Also: remediation tracking does not track — fix_tracking is a string nobody reads, so an owner who goes quiet and a fix that goes quiet look identical; there is no intake path for incidents or external reports, so the register is a self-assessment aggregator rather than what INTENT claims; and no coverage model, so a system with zero findings is indistinguishable from one nobody assessed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| assessments | ||
| method | ||
| regulatory | ||
| rulings | ||
| verifications | ||