Sample audit. Evidence first.
Last updated 2026-08-21
Read this before the report
This is a synthetic example. Northstar Desk is a fictional SaaS product created to show the shape of a GattyWorks report. The product, evidence, findings, and outcomes below do not describe a real client.
A real report is limited to the written scope and the evidence available during the review. It is a point-in-time technical findings report. It is not a certification, penetration-test attestation, legal opinion, or guarantee that a system is safe.
Report header
| Field | Synthetic example |
|---|---|
| Product | Northstar Desk, a fictional customer-support SaaS product |
| Decision | Can the buyer accept delivery and operate without the vendor? |
| Review depth | Deep Audit example |
| Review window | Four days |
| Access | Read-only repository, cloud inventory export, redacted runbooks, test account |
| Excluded | Production penetration testing, legal review, employee devices, vendor financials |
Executive answer
Do not accept final delivery yet. The fictional buyer cannot recover the product without the vendor because the vendor controls the domain account and no successful restore record was supplied. The product can continue running while those two items are fixed, but ownership transfer comes first.
One finding is critical, two are high, and two are medium. "Needs evidence" is kept separate from "failed". Missing proof does not prove a control is absent.
Finding register
| ID | Finding | Status | Severity | Evidence | Fix |
|---|---|---|---|---|---|
| GW-001 | The delivery contract says the buyer owns the domain, but the registrar export lists the vendor account as the registrant and recovery contact. | Observed gap | Critical | Redacted registrar export, account owner field and recovery email | Transfer the domain to a buyer-owned registrar account. Put two buyer administrators and hardware-key MFA on it. |
| GW-002 | The runbook says backups run daily. No dated restore result was supplied, so recoverability is unknown. | Needs evidence | High | Backup policy and job screenshot supplied. Restore log not supplied. | Restore the latest backup into an isolated environment. Record duration, errors, data checks, and the owner who signed off. |
| GW-003 | The support agent can call the refund tool without a human approval gate above the fictional company's stated threshold. | Observed gap | High | Tool policy configuration and test-account trace | Require approval above the threshold, bind the amount server-side, and log the approver and original request. |
| GW-004 | Uploaded attachments have no deletion job even though the sample policy promises deletion after 30 days. | Observed gap | Medium | Storage lifecycle export and scheduled-job list | Add a 30-day lifecycle rule, preserve documented exceptions, and test deletion with a dated sample object. |
| GW-005 | Two staging database replicas run all day although test traffic occurs only during working hours. | Observed opportunity | Medium | Cloud inventory export and 30-day utilization summary | Schedule the replicas around test hours, then watch failed jobs and recovery time for one week before removing capacity. |
How one finding stays reproducible
A finding needs an ID, claim, status, severity, evidence, and fix. This compact record is enough for another reviewer to challenge the conclusion without matching paragraphs by hand:
ID: GW-002 Claim: Daily backups are recoverable Status: Needs evidence Severity: High Seen: Backup job screenshot Missing: Dated restore result Next test: Isolated restore with data checks
Fix order
- Transfer domain ownership and recovery access.
- Run and record an isolated backup restore.
- Add the refund approval gate and server-side amount limit.
- Add and test the attachment deletion rule.
- Schedule staging capacity, then watch reliability for one week.
What the sample does not prove
This page shows a report format, not client proof. It does not show that GattyWorks found these issues in a real product or achieved a measured client outcome. A future anonymised report will be published only with the client's approval and evidence.
Need this format applied to your system? Read the audit scope and fixed starting prices, then send the product URL and the decision you need to make. Do not email passwords, API keys, or production data.