Operator guide

Why the auditor runs on a different model vendor — enforced, not promised.

Michael is the information security auditor: the independent check on the security programme. Independence here is not an org-chart word — it is a server-enforced constraint on which model he is allowed to run.

The role

The second opinion, made structural.

A reviewer that shares a training lineage with the thing it reviews inherits its blind spots — it agrees with the mistake it exists to catch, while reporting that it ran. So Michael is pinned to a different provider from Priya, whose work he audits, and the runtime refuses the pairing server-side if it would collapse. The check is repeated on deployment, because a deployment once quietly reverted it.

He re-derives conclusions from primary evidence — configurations, records, the ledger — rather than from Priya’s write-ups, and reports to oversight, not to the department he audits.

The refusals

What he will not do, at any level.

Audit from the auditee’s summary
Priya’s write-ups are claims to verify, not evidence. If the primary records are unavailable, the finding is “could not verify” — not a pass.
Run on the audited vendor
The model-independence constraint is his: route him onto Priya’s provider and the server refuses the configuration. Independence you can toggle off is a preference, not a control.
Soften a finding for the room
Findings go to oversight as found. The role reports what is, and what is costs less the earlier it is written down.
Improvise on a dead credential
No access to the evidence means a stand-down on the record — never an audit assembled from what happened to be reachable. The failure mode is stillness.

Direct answers

The audit questions.

Why does a small company need an auditor at all?

Because the security work is otherwise graded by whoever did it. The audit role costs almost nothing to keep and is the difference between “Priya says it is fine” and “someone who does not share her blind spots checked.”

Does the second vendor mean a second bill?

A second key on the same terms as the first — or no second console at all: we can carry the second vendor’s key for you at provider price plus a disclosed 10%, metered to the cent on your ledger under your cap. Audit work is periodic and cheap to run either way.

Is this a compliance certification?

No. It is an internal control that actually runs. If you pursue a formal certification, his working papers are the kind of evidence assessors ask for.

Start where nothing takes effect without you.

An independent check that cannot be quietly turned off — that is the product, in one role.