12.5 The Quarterly Audit

Once a quarter, ninety minutes, forty checkpoints, four possible decisions. The audit exists because every other chapter in this book describes a practice that decays: the bible drifts, the library accumulates, the disclosure posture lapses, the SOP stops matching reality, and none of it announces itself.

The audit is where the decay is found on your schedule rather than on an incident's.

How to run it

One sitting, ninety minutes, once a quarter. Calendar it. An audit done in fragments across a month is not an audit; it is a feeling.

Answer in writing, in the sheet, with a date. The written record is what makes the next quarter's audit cheap, and what makes 12.6's exit possible — a buyer or a licensee is buying documentation as much as an account.

Score each checkpoint pass, fail, or not applicable. No partial credit, because partial credit is how a lapsed disclosure becomes "mostly fine."

Stop at the first failure in each section and fix it before continuing. The sections are ordered so that earlier failures make later answers meaningless.

The forty checkpoints

Technical (10).

1. Adapter, base model, and custom-node versions pinned and recorded (7.2)?
2. Base model hash matches what the adapter was trained on (4.5)?
3. Smoke test passes: three frames at production settings, on-identity?
4. Reference library complete — face, body, outfits, locations — with no missing entries (5.3)?
5. Backup verified by an actual restore of one folder (7.4)?
6. Prompt list refilled to forty variants (5.2)?
7. Node graphs run end to end without manual intervention (7.2)?
8. QA rejection rate within its normal band (5.6)?
9. Deliverable checklist passes for all platforms in use (6.7)?
10. No orphaned or duplicated assets from failed runs (7.4)?

Distribution (10).

11. Primary platform disclosure posture current for every post in the last quarter (11.3)?
12. Secondary platform active, not merely existing (8.1)?
13. Ownership channel growing — captures up quarter over quarter (10.1)?
14. Cadence sustained at the planned rate for the full quarter (8.3)?
15. Format mix intentional, and at least one format test run this quarter (8.2)?
16. Comment harvesting done — repeated questions fed into the content plan (8.6)?
17. Brand kit and visual signature consistent across the quarter's grid (2.5)?
18. No channel dependency: growth attributable to more than one source (8.4)?
19. Profile elements current — bio, pinned posts, link destination (8.2)?
20. Analytics recorded per persona, not per account (12.2)?

Financial (10).

21. Cost per published post known and compared to last quarter (7.5)?
22. Pipeline spend within the planned tier, with no unexplained variance?
23. Prepaid credit balance under one quarter of consumption (12.4)?
24. Revenue composition known — chat, subscription, brand, product — with shares (9.1)?
25. ARPU and churn computed for the quarter (10.4)?
26. Revenue per hour computed per persona (12.3)?
27. Subscription utilization measured, with a tier decision if under a third (7.5)?
28. Price reviewed against the market and against cost (9.4)?
29. Every revenue stream has a decision attached, or has been stopped?
30. One year of records retained and accessible (7.3)?

Compliance (10).

31. AI Act transparency duties reviewed against the current transition state (11.1, 11.3)?
32. Platform policies re-read for the primary platform this quarter (8.1)?
33. Disclosure templates current and used on every post (11.3)?
34. Likeness and training-data rights documented, with consents where required (11.4)?
35. Provenance and metadata records complete for published work (7.4, 11.5)?
36. EU consumer duties for digital sales reviewed — withdrawal rights, VAT handling (11.8)?
37. Privacy notice current, covering chat logs and retention (11.7)?
38. Contractor arrangements documented, with conduct and confidentiality terms (10.5)?
39. Ethical line reviewed against the never-publish list (11.6, 12.4)?
40. This audit itself documented, with the date and the decisions (12.5)?

The four decisions

Answer these in writing at the end. They are the reason the audit exists.

The distinction that matters most is between Fix and Wind down. Fix applies to a broken thing, Wind down to a thing that works and does not pay. Operators habitually choose Fix for both, which is how an account with three regular subscribers consumes six hours a week for years.

When the process itself has aged

The audit finds broken practices. This is the question that finds a broken process: what did I do differently this quarter because the written procedure did not fit?

Three signals that the SOP needs rewriting rather than following:

Steps you skip every time. Either unnecessary — delete — or necessary and you are accumulating risk (7.6). Decide which, in writing.

Steps that take twice their estimate for three consecutive quarters. The estimate is wrong or the step is.

Work that has moved outside the SOP entirely. Something you now do by habit that is not written down. It is either a step to add or a step to delete.

Rewrite the SOP once, when two of the three signals appear. Version it with a date and a reason, the same discipline as 4.7's adapter versions.

Documenting the findings

One file per quarter, and it becomes the most valuable document you own.

Four sections: what passed, what failed, what was decided, and what was changed. Two hundred words per section is enough.

Why it matters beyond the audit. It is the evidence trail for 12.6's exit — a buyer or licensee wants to see a business that has been run deliberately. It is the input to the next audit, which is then a comparison rather than a blank page. And it is the only reliable defence against repeating a mistake, because memory of a decision two years old is not a record.

And one habit that makes it nearly free: append to the same file each quarter rather than creating a new one. Four entries a year, one document, a history.

What makes this audit cheap

Ninety minutes is the estimate for the second audit onwards. The first one takes half a day, and the difference is entirely in what you kept.

Three things that make every subsequent audit fast:

One spreadsheet, appended to, never restarted. The audit reads the last four rows and compares. A new file each quarter means re-deriving the history every time, which is why most audits get abandoned after two rounds.

The checkpoint list stored with the sheet. Not remembered, not regenerated. The forty items above are the list; the sheet has a column per quarter, and a pass is a tick. [AS OF 2026-10] The compliance section's contents will change as the EU transition proceeds through 2 December 2026, so the list is a living document rather than a fixed one.

Decisions written in the same row as the findings. Not in a separate notes file, not in a chat message to yourself. The row is the record, and 12.6's diligence wants exactly that.

The honest note about why audits fail: not because they take ninety minutes, but because they produce information nobody acts on. The four decisions at the end are the mechanism that prevents this. An audit with no decision attached is a form, and forms do not survive a busy quarter.

Where this goes wrong

No audit at all. Decay discovered by incident.

Fragmented across a month. Not an audit.

Partial credit. How a lapsed disclosure becomes "mostly fine."

Fix chosen when Wind down applies. Hours consumed indefinitely by a thing that does not pay.

No written record. The next audit starts from nothing and the exit has no evidence.

Skipping the compliance section because nothing has changed. It changes every year, and the EU regime is transitioning through 2 December 2026.

Rewriting the SOP every quarter. Churn instead of maintenance; rewrite on the two-of-three signal.

The gate

1. Is the audit calendared, one sitting, ninety minutes, quarterly?
2. Do you score pass, fail, or not applicable, and stop at the first failure in each section?
3. Have you made one of the four decisions in writing?
4. Did you check whether the process itself has aged, not only whether it was followed?
5. Is there a single accumulating audit file with a dated entry per quarter?
6. Can you produce last quarter's decisions right now?

What you leave with

A ninety-minute quarterly routine with four operating rules, forty checkpoints across technical, distribution, financial, and compliance categories, four end-of-audit decisions with the distinction between fixing a broken thing and winding down a working one, three signals that the process has aged rather than been broken, and a single accumulating record that serves the next audit, the exit, and the compliance evidence trail at once.