Source · OIDA Cloud

# Observation 004: Client Report Assembly Process **Date:** October 7, 2025 **Observer:** Yuki Tanaka (Analyst, Meridian Labs LLC) **Location:** ClearPath Solutions Inc., Florence office **Duration:** 3 hours 30 minutes **Subject:** One compliance consultant (Riccardo Boni) assembling a client audit report --- ## Summary Observed a compliance consultant, Riccardo Boni, assembling a full audit report for a financial services client. The engagement was for a standard ISO 27001 controls review. Work began at 10:15 AM and ended at 1:45 PM with client delivery. ## Timeline of Activities **10:15–10:45**: Consultant opened a report template from the shared drive. Noted that the template was dated 2022 and lacked some recent formatting guidance. Consultant then searched Slack for a newer version and found a message from another consultant saying, "Use the one I sent you on Sept 20 — the shared drive one is ancient." **10:45–11:20**: Consultant located and used a more recent template (dated Sept 2025) found in a team member's email attachment from a previous week. **11:20–1:20 PM**: Primary work phase — approximately 60% of the content was copy-pasted from a previous client report for the same client (annual follow-up). Consultant manually updated client names, dates, and section headers. Approximately 40% of content was newly written or significantly revised to reflect current control assessments. **1:20–1:35 PM**: Quality review by consultant. During this phase, two broken Excel formulas in the embedded compliance matrix were identified. Consultant corrected one formula but said the other "should still work even if the display is odd — I'll note it as a known issue." **1:35–1:45 PM**: Final formatting and PDF export. Report delivered to client. ## Key Observations 1. **Template Fragmentation**: Multiple versions of the report template exist across the organization — shared drive, personal email, Slack messages. No single source of truth. 2. **Copy-Paste Workflow**: The majority of report content was not newly generated but adapted from prior reports. While some adaptation is reasonable for repeat clients, the lack of a structured template or systematic approach led to manual find-and-replace operations that are error-prone. 3. **Formula Errors**: Two of the embedded Excel formulas in the compliance matrix were broken. One was corrected; the other was left as-is with an informal note about a "known issue." 4. **Time Investment**: Approximately 3 hours were invested in report production for what appears to be 60% reused content and 40% new analysis. 5. **Process Fragility**: When the official template was unavailable or unknown, the consultant relied on peer-to-peer communication (Slack, email) to locate working versions. This works on a small team but creates risk of version skew. ## Brief Feedback Riccardo mentioned informally: "The templates should really be in one place and kept up to date. I spend too much time hunting for the right version." --- **Notes for Follow-up:** - Clarify whether copy-paste from prior reports is an intentional practice or a workaround for missing template content. - Assess whether the Excel formula errors represent a systematic issue or isolated incidents. - Determine whether the "known issue" comment was appropriate risk acceptance or a missed correction.

Observation 004 — client report assembly

What was taken from it