Continuous auditing and flags

Exception rules run on product data daily or weekly: approval above the ceiling, accumulating two conflicting roles, a purchase order with no contract, a privileged account with no second factor. What they detect does not become a finding automatically — it becomes a flag that an auditor examines and then decides on. Read from source systems DATA-REQ-016 NFR-REQ-003