{
  "format": "vercy-enterprise-profile-candidate/v1",
  "contourId": "EM-RSK-02",
  "name": "Enterprise Audit and Assurance",
  "decision": "PROFILE",
  "newRuntimeId": false,
  "bases": [
    "WM-ECO-035",
    "WM-ACT-033",
    "WM-KNW-014",
    "WM-KNW-007",
    "WM-ACT-006",
    "WM-KNW-012"
  ],
  "candidateRevision": 3,
  "candidateStatus": "provider-reconciled-audited-remediated-allocation-held",
  "publishable": false,
  "profileRole": "exclusive composition and correspondence-only seam",
  "basePlaceholders": [
    {
      "name": "Procedure Definition",
      "modelId": null,
      "registryId": null,
      "allocationState": "unassigned",
      "required": true
    }
  ],
  "instantiable": false,
  "constraintRules": [
    {
      "id": "P01",
      "rule": "WM-ECO-035 exclusively masters Engagement, Mandate, declared scope, exclusions and AssuranceOpinion."
    },
    {
      "id": "P02",
      "rule": "WM-ACT-033 exclusively masters commissioned Execution, performed test, observation, evidence package and AuditFinding."
    },
    {
      "id": "P03",
      "rule": "Engagement commissions Execution; one Execution belongs to one Engagement; activity occurs only inside its authorized period, while retained records remain immutable and resolvable after closure."
    },
    {
      "id": "P04",
      "rule": "No merged Audit root, third Audit master or same-instance dual mastership is permitted."
    },
    {
      "id": "P05",
      "rule": "AuditFinding reuses WM-ACT-033 and aligns to WM-KNW-007 without a second identity; WM-KNW-014 Issue remains distinct."
    },
    {
      "id": "P06",
      "rule": "AssuranceOpinion has WM-ECO-035 engagement-scoped issuance identity (engagementRef plus issuanceSequence), cites period, assurance level, modification, use restrictions, evidence limitations, exclusions and frame gaps, and never proves general compliance or closes a finding."
    },
    {
      "id": "P07",
      "rule": "CorrectiveAction profiles WM-ACT-006; management response is a separate assertion attached to the finding."
    },
    {
      "id": "P08",
      "rule": "Finding, issue, risk, control, task, opinion, response and action retain distinct identities and attributed links."
    },
    {
      "id": "P09",
      "rule": "Closure requires a new independent performed test against the same pinned criteria and cell; successor cell requires issuance-authority authorization and recorded equivalence rationale."
    },
    {
      "id": "P10",
      "rule": "Retest executor differs from corrective-action actor; performed-test executor differs from process owner; opinion issuer is independent of audited management."
    },
    {
      "id": "P11",
      "rule": "Tests, observations, evidence references/packages, findings, responses, retests, reports and opinions are append-only; withdrawal requires reason and authority and never edits the predecessor."
    },
    {
      "id": "P12",
      "rule": "The profile mints no subject identity and cannot mutate or cascade-delete any master."
    },
    {
      "id": "P13",
      "rule": "WM-ECO-035 masters the engagement criteria binding and issued report artifact; report does not duplicate AssuranceOpinion identity."
    },
    {
      "id": "P14",
      "rule": "WM-ACT-033 masters performed-test sampling records and engagement-scoped management-response assertions shaped by WM-KNW-007, never WM-ACT-006 actions."
    },
    {
      "id": "P15",
      "rule": "Finding closure decision is recorded by the engagement issuance authority, cites closure criteria and retest; corrective actor, audited management and retest executor cannot decide closure."
    },
    {
      "id": "P16",
      "rule": "Opinion supersession issues a new engagement-scoped issuance referencing the withdrawn predecessor; original remains immutable."
    }
  ]
}