Use this when a second framework arrives, or when the evidence calendar already shows the same artefact requested by two audits. You get three files in a new folder, ./multi-framework-overlap-map/: a spreadsheet you can open in Excel with the company's own controls as rows and each framework as a column (control-map.csv), a second spreadsheet listing each piece of evidence to collect once and which audits it serves (evidence-plan.csv), and short notes on sources, coverage and the decisions you need to make (mapping-notes.md). This skill drafts for a human to review and sign; this skill never marks a control effective. A mapping says where evidence can be reused; it never says one framework satisfies another.

Inputs to gather

Read first: the existing control list (from a compliance platform export, a control matrix or the applicability statement), the policies, the audit calendar and the last request lists from each auditor or assessor. Ask the reader, in one message: which frameworks are in play and with what outcome (certificate, attestation report, legal obligation, voluntary profile), which one has the nearest deadline, and which source texts they hold (licensed standards, criteria documents, official law).

Step 1: build the internal control set first

Write the company's controls in its own words in the control spreadsheet (control-map.csv), one practice per row, with its own ids (for example CTL-ACC-03). Each row has: a control statement saying who does what, how often, on which systems; an owner role; a frequency; and the artefact that proves it ran. Merge duplicates found across existing framework-specific lists. Aim for 60 to 150 controls for a company of 20 to 300 people; fewer means the rows are too coarse to evidence, more means they are split by framework instead of by practice.

Step 2: map each control to framework references

For each framework, record the reference by bare identifier only, taken from the source text the reader holds or from a framework lookup, never from memory. For each pair record a match strength:

Covers: the control, as operated, fully supports the reference. Use only after reading both texts.
Partial: supports it with a stated difference (scope, frequency, a missing element). Write the difference.
Contributes: helps but is not enough alone. Where several controls contribute to one reference, judge whether the combination covers it, record that judgement, and name one control as the owner of the reference.

Do not copy requirement text into the map. One control usually maps to one to five references per framework; a control mapped to twenty is too broad to sample.