CANON: The Standard of Proof (the auditor’s chair)

COMMISSIONED. The continuity bible for The Standard of Proof, promoted to the same status as CANON.md: when a post and this file disagree, fix the post, or fix this file in the same PR if the post is right.

This story is standalone: new cast, new companies, no shared characters with any other series. It touches the shared universe at exactly one seam, described below, and that seam is a name on a contract and nothing more.

Everything institutional is fictionalised, per the Permit Office rules. No real assurance standard is ever named. The engagement is “an independent assurance engagement” under “the scheme”; the firm’s manual is “the manual”; the report is “the report”. The shape follows how assurance engagements actually work, because the realism is what makes the constraints legible, but no real standard, framework, clause number or certifying body appears.

Premise

Hema Durrani has five days inside a company she has never seen, no authority to change anything, and one artefact at the end: a report.

She is not there because anybody did something wrong. She is there because a customer’s contract says somebody independent has to look. Stavely Systems makes temperature loggers and the data platform behind them, and one of its customers is a cold-chain provenance company whose whole proposition is that its record can be trusted, which means Stavely’s record has to be trustworthy too, which means an annual assurance report.

The story is the engagement, from the chair nobody writes from.

The seam with the shared universe

Stavely’s customer is Relay, named in the engagement letter, in one scene in post 1 and in passing twice more. Relay never appears: no Relay character has a line, no scene happens inside Relay, and nothing about Relay’s own systems, people or history is described beyond the fact that its supplier contract requires this report.

CANON-RELAY.md wins on any Relay fact. The seam exists because auditing a provenance record is the natural subject for this story, and it is kept to a name so that nothing here can contradict a completed four-season narrative. Do not extend it. Any draft that gives Relay a scene, an opinion or a named person is wrong.

Vantage, which is the whole design

The reader sees only what Hema sees. She has no authority to compel, no access she is not given, and no way to know what happens in the rooms she leaves. Scenes are the meeting, the desk she is lent, the corridor, the call with her own firm, the hotel room where she writes.

What Stavely’s people think arrives only through what they say, produce and do. Hema may infer; the narrator may not peek. When somebody is evasive, the story never confirms whether they were hiding something or having a bad week, because Hema never finds out either.

This is the constraint the story exists to explore: she has to reach a defensible conclusion from a sample, in five days, with no power, and write it in a form that survives a hostile reading.

The clock

Publication	Story time	Beat
Apr 2032 (posts 1-2)	Feb 2034	The engagement letter; day one
May 2032 (posts 3-5)	Feb 2034	Sampling; the control that stopped running; the thing she was not looking for
May - Jun 2032 (posts 6-7)	Feb - Mar 2034	The pressure; writing the report
Jun 2032 (posts 8-9)	Mar 2034, Apr 2035	The exit meeting; a coda a year later

Story time sits in 2034, after Relay’s own narrative, so nothing reaches backwards into it.

Cast

Names collision-checked against all CANON files and the post corpus at commissioning.

Name	Role	Notes
Hema Durrani	Senior manager, the assurance firm, protagonist	Thirty-eight. Nine years in assurance after four as a platform engineer, which is why she can read a deployment pipeline and why clients consistently underestimate her in the first hour. Good at the job and the story’s engine is that she is right and it is inconvenient. Dry, patient, and completely unmoved by charm. Her private difficulty is that she likes the people she is auditing, every time, and it has never once changed a finding.
Rowan Mottram	Partner, the assurance firm	Signs the report, carries the client relationship and the firm’s exposure. Not a weak link and not a villain: when the pressure comes in post 6 he is the one who absorbs it, and his question to Hema is harder than anything Stavely asks her.
Chidinma Okpara	Head of compliance, Stavely	Hema’s counterpart and the person who booked the engagement. Wants a clean report and wants it honestly, in that order, and the tension between those two wants is where she lives. Competent, overloaded, and the only person at Stavely who has read the contract.
Barnaby Quist	CTO, Stavely	Built the platform. Hates the engagement, says so on day one, and is the most useful person in the building because he answers precisely what he is asked and does not volunteer. Comes round in post 8, which he would deny.
Tarik Osman	Senior engineer, Stavely	Tells Hema the truth in post 4 because she asks him a question nobody has asked him, and then has to live at Stavely afterwards. The story takes seriously what it costs him and does not make him a hero about it.

The companies

The assurance firm is never named. Mid-tier, Perth office, national. Hema’s team on this job is herself and one junior who is offsite and appears only in calls.
Stavely Systems: Melbourne, 140 staff, eleven years old. Makes temperature loggers (the hardware) and the platform that ingests, stores and signs their readings. Its proposition to customers is that a reading, once taken, cannot be altered without detection. Profitable, well run, and not hiding anything.
Relay: Stavely’s customer. Appears as a name on a contract. See the seam rule above.
The scheme: the fictional assurance scheme the report is issued under. Annual. The report is addressed to Stavely’s management and provided to its customers. It is not a certification and nobody in the story calls it one.

The engagement, and its real constraints

Five days onsite, one senior, plus three weeks of off-site work before and after. The budget is fixed and was quoted in September.
Scope is agreed in advance and in writing, and it is already slightly wrong on day one, because it was written in September against a system that shipped a major change in December.
She cannot compel anything. Everything she sees, somebody chose to give her. Where they decline, her only instrument is to write down that she asked and did not receive, which is both weaker and stronger than it sounds.
The population she cannot examine exhaustively: 11,000 logger configuration changes in the year. She samples 40.
Independence is the whole value. The firm cannot advise Stavely on a remedy and then assure it, and post 5 is where that bites: Hema can see the fix and may not suggest it, which reads as unhelpful and is the reason anybody trusts the report at all.

Canonical numbers (printed in posts; update here when a post moves them)

Population: 11,043 logger configuration changes in the year to 31 December 2033. Sample: 40, selected by a documented method.
Post 3: the sample is 40 because that is what the manual’s table gives for the population size and the degree of assurance; Hema can state what a clean sample of 40 supports and what it does not, and the post prints both.
Post 4: the quarterly access review ran in January, April and July 2033 and has not run since 24 July. Two of the four quarters.
Post 4: 31 accounts carried administrative access to the signing service; 4 of the 31 belonged to people who had left Stavely, the longest 7 months earlier. None had been used after the leaver’s last day, which Hema verifies and says in the finding.
Post 5: the thing she was not looking for is in the staging environment: real customer readings, 2.1 million of them, copied into staging in 2031 for a load test and never removed. Outside her scope. In scope for Stavely’s obligations to its customers.
Post 6: Stavely asks for the access-review finding to be reclassified from a control deficiency to an observation. The difference matters because the report goes to customers. Three hours.
Post 7: the first draft has 11 findings; the issued report has 8, and one paragraph is removed because the evidence does not reach it.
Post 9: the coda is April 2035. The leaver-access finding is the one that turns out to have been cheap.

Domain language

“the engagement” for the job, “the scope” for what was agreed, “fieldwork” for the five days onsite
“control” for a thing the company does to manage a risk; the story distinguishes a control that exists (designed, documented) from one that operates (ran, in the period, on the population), and that distinction is the spine of posts 3 and 4
“finding” for something that goes in the report; “observation” for something noted and not classified as a deficiency
“the population” and “the sample”
“evidence” means something she has seen, and the story is pedantic about it: being told a thing is not evidence of the thing
“management response” for what the client writes under each finding
never “audit” as a verb about people (“auditing the team”), only about subject matter

Story rules

All CLAUDE.md chronology rules apply: story time forward with publication order; techniques and vocabulary only after their introducing post; series-link backward only; never break the fourth wall; no publishing-unit words in prose. The narrator never steps out to comment on the shape of the narrative; this was the fault found and fixed across two other arcs and it is named here on purpose.
Hema is good at the job and the reader can see why. The failure mode for this story is an auditor who reads as a villain or a bureaucrat. The guard is that every finding she makes is correct, every question she asks is one the reader wishes somebody had asked, and she is visibly better at understanding Stavely’s system than Stavely expected.
The stakes are somebody’s, never a framework’s. No scene turns on compliance for its own sake. The access-review finding matters because four people who left could have signed a temperature reading; the staging data matters because 2.1 million real readings are sitting where nobody is watching them.
Nobody at Stavely is corrupt. Barnaby’s hostility is a busy engineer’s contempt for ceremony and it is half-earned. Chidinma’s pressure in post 6 is a person doing her job under a commercial constraint, and she never asks Hema to lie. The reclassification request is reasonable on its face, which is what makes it hard.
Independence costs something visible. Hema cannot design the remedy. In post 5 she watches Stavely head towards a worse fix than the one she can see and says nothing about how to do it, and the story sits in how unhelpful that feels before explaining what it buys. (The explanation is one line in dialogue, not a lecture.)
The report is the deliverable and the craft of it is a subject. Post 7 is about sentences: what survives a lawyer, what the evidence supports, the paragraph taken out because it reaches past what she saw. A finding written to be acted on, not to be filed.
New techniques this story introduces (scope negotiation, sampling a population you cannot examine exhaustively and stating what the sample supports, the difference between a control existing and operating, evidence and what counts as it, writing a finding that gets acted on, independence and what it forbids, the out-of- scope discovery and the obligation it creates, the management response) follow the introduction rules. Techniques the blog already teaches may be linked backward on natural phrases.
Posts are Tuesday mornings, standalone series (no collection), series: "The Standard of Proof", story banner on every post.

The posts (9, pub 2032-04-27 → 2032-06-22)

#	Pub date	Title	Beat	Teaches
1	2032-04-27	The Scope Was Written in September	The engagement letter, read on a plane. The scope was agreed against a system that shipped a major change in December, so it is wrong before she lands. What she can and cannot do about that.	Scope negotiation; why an engagement is constrained before it starts.
2	2032-05-04	Everyone Is Helpful and Nothing Is Produced	Day one. Three meetings, excellent coffee, a lent desk, and by five o’clock not one artefact. Barnaby tells her the engagement is theatre. Chidinma means well and is in another meeting. Hema’s day-one method: ask for the thing, not the explanation.	Evidence: being told a thing is not evidence of the thing.
3	2032-05-11	Forty of Eleven Thousand	Sampling. Why forty, chosen a way she can defend, selected in front of Chidinma so nobody can say she picked them. What a clean sample of forty supports and what it does not, stated in both directions.	Sampling a population you cannot examine exhaustively; stating the limits of what the sample supports.
4	2032-05-18	It Has Not Run Since July	The access review is beautifully documented and ran in two of four quarters. Thirty-one admin accounts on the signing service, four of them leavers. Tarik Osman answers the question nobody has asked him.	A control that exists against a control that operates.
5	2032-05-25	Two Point One Million Readings in Staging	Out of scope, and real. Hema has to decide what she is obliged to do with something she was not looking for, and then watch Stavely choose a worse remedy than the one she can see, and say nothing about how to fix it.	The out-of-scope discovery; independence and what it forbids.
6	2032-06-01	Reclassify It	Three hours. Stavely wants the access finding moved from deficiency to observation, and the request is reasonable on its face. Rowan Mottram takes the call and then asks Hema the hardest question of the engagement, which is not whether she is right.	Holding a finding; the difference between pressure and an argument.
7	2032-06-08	The Paragraph That Came Out	Writing it. Eleven findings become eight. One sentence is rewritten four times to survive a lawyer, and one paragraph is deleted because the evidence does not reach it, and deleting it is the hardest thing she does all engagement.	Writing a finding that gets acted on; saying only what the evidence supports.
8	2032-06-15	The Exit Meeting	The findings read out, management responses taken, one argued properly and conceded by Hema on the evidence. Barnaby says the only generous thing he says all week and immediately spoils it.	The management response; what an exit meeting is for.
9	2032-06-22	The Cheap Warning	Coda, April 2035. A year on, the leaver-access finding turns out to have been the cheap version of a conversation Stavely would otherwise have had with a customer’s lawyers. What the report was worth, and the two findings that changed nothing.	What independent assurance is actually for, and its honest limits.

Every post ends with a next-chapter-notice.html include pointing at the next post (estimated date = its publication date), except post 9.