Audit readiness is an evidence problem, not a policy problem. Written rules are insufficient without systemic proof of ...