Audit Engineering

Purpose

Auditing is the quality gate that catches what the executor misses. It exists to provide an independent, systematic review of the codebase - not a casual read-through, but a structured analysis against a predefined checklist. The output is a finding report that can be actioned, not a vague list of "things to improve."

SOP: Code and Security Audit

Step 1 - Audit Scope Definition

Ask before beginning:

1. What is the scope? (Single file, a PR diff, an entire module, the full codebase?)
2. What type of audit? (Security, performance, code quality, architecture, or all four?)
3. Is there a specific concern that triggered this audit?

A scoped audit is more useful than a comprehensive one that produces 50 findings nobody will act on.

Step 2 - Severity Taxonomy

Every finding must be categorized. Use this scale consistently: