# CRM audit: <instance label>, <CRM>

## Baseline

- CRM and instance: <HubSpot | Salesforce | Attio | other>, <placeholder label such as portal 1234567>, <production | sandbox>
- Edition or plan: <from the order form or billing page, not a pricing page>
- Read time: <YYYY-MM-DD HH:MM UTC>; as of date used for ages: <YYYY-MM-DD>
- Routes: <admin exports | vendor MCP server read tools | CLI read commands>, with what each covered
- Reading identity: <role label>; can write: <yes | no>; write tools denied in the client: <list, or "none needed">
- Scope: <full, 56 rules | gates only, 13 rules plus both inventories>
- Scripts: <command lines run, or "scripts not run, rules applied by hand">
- Summary line: <N FAIL, N WARN, N PASS, N NOT CHECKED, N N/A (56 rules). Nothing was changed.>
- martech-context files read: <stack.md, data-dictionary.md, decisions.md, metrics.md, naming-rules.md, or "none">

## Verdicts

- Automation readiness: <Ready to automate | Not ready until owned | Not assessable | Fix gates first> (<gates behind it, and any NOT CHECKED part of a passing or warning gate with what to collect>)
- Reporting readiness: <Ready to report from | Not ready until owned | Not assessable | Fix gates first> (<gates behind it, and any NOT CHECKED part with what to collect>)

## Scorecard

The score ranks where to look; the verdicts decide readiness.

- OBJ Objects, associations and identity: <score and band, or insufficient evidence>, coverage <percent>
- FLD Properties and field governance: <...>
- PIPE Pipelines and stages: <...>
- LIFE Lifecycle and lead status: <...>
- AUTO Automation and workflows: <...>
- ACC Users, permissions and teams: <...>
- INT Integrations and sync ownership: <...>
- REP Reporting readiness: <...>
- Overall: <score, or "not computed" when fewer than six domains have a score>

## FAIL

- <RULE-ID> <rule name> (<gate>, class <A | B | C>)
  - FAIL: <finding with numbers, population and record IDs>
  - Note: <not checked parts, partial coverage, unclassified actions>
  - Evidence: <EV-n, kind: what it shows (file in the private working folder)>, or "unconfirmed; attach one item from references/qa-evidence.md"

## WARN

- <RULE-ID> <rule name> (<gate>, class <A | B | C>)
  - WARN: <finding>
  - Evidence: <EV-n; for a gate WARN without one, unconfirmed>
  - Decision needed from: <owner role>

## PASS

- <RULE-ID> <rule name> (class <A | B | C>)
  - PASS: <what was checked and why it passes>

## NOT CHECKED and N/A

- <RULE-ID> NOT CHECKED: <reason>. Evidence that would close it: <export, capture or count to request>
- <RULE-ID> N/A: <why the rule does not apply>

## Critical field writers

- <object.field> (<class>): permitted <writers>; observed <writer (sources)>; precedence <rule, or none written>; flip-flop records <n, or no history>; fill <n of d (percent), population <name>, or not counted>

## Integration inventory

- <name> (<type>): identity <identity type>, owner <role or NONE>, direction <into_crm | out_of_crm | two_way>, objects <list>, match key <key per object>, creates <objects>, writes <fields>, blank behaviour <preserve | clear | undefined>, in stack.md <yes | no>

## Counts and populations

- <count name>: <numerator> of <denominator> (<percent>), population <definition>, query <query or export>, read <time>

## Unclassified workflow actions

- <workflow>: <action type IDs>. Open it and add its field writes, deletes and consent actions to the inventory overlay. Or "none".

## Checked outside the inventory

- <EV-n> (<rule>, <kind>): <summary>; <file in the private working folder>
- Writer samples: <fields, window, writer_history.py summary>
- Record traces: <record IDs and what each showed>
- Reconciliations: <metric, dashboard value, record-list value, difference, cause>
- Access views: <identity, field or object, grants found, matches the approved list or not>
- Settings captures: <setting, value, matches decisions.md or not>

## Overrides

- <threshold path>: <default> -> <value> (<reason>)

## Script warnings

- <warning printed by audit_crm.py: a rejected downgrade, not_applicable ignored on a gate, an unknown enum value>, or "none"

## Proposed martech-context updates

Nothing is written until the user approves.

- stack.md: <integrations found, owners, identities, retired systems>
- data-dictionary.md: <critical field meanings, writers and blank meanings>
- decisions.md: <open decisions: precedence rules, lifecycle definitions, restricted fields, accepted exceptions>
- metrics.md: <missing counting units, timestamps, timezones, exclusions>

## Next step

- Change list: <path>. Nothing in the CRM was changed by this audit.
- Questions for owners: <one line each, with the owner role>