Pre-audit gap sweep

[CLIENT NAME] has a [FRAMEWORK] audit with [AUDITOR] on [AUDIT DATE]. Using ControlMap, find everything likely to produce a finding:
- Controls without evidence, or with evidence that won't cover the audit period
- Policies not approved, overdue for review, or not acknowledged by staff
- Risks without treatment, and action items still open
- Evidence that's weak: screenshots without dates, partial coverage, wrong system

Rank by likelihood of a finding and build a week-by-week plan to fix them before the audit. Before you create, update or delete anything, show me exactly what you plan to change in a table and wait for my approval. After approval, create the fixes as action items.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.

When writing to ControlMap:
- Update policies one field per request. review_date must include milliseconds (2027-01-01T00:00:00.000Z) and policy status must be draft, in_progress, in_review or approved.
- Risk scores and treatment can't be changed through the API. A new risk takes one impact and likelihood, which sets inherent, current and target together. List any score or treatment changes for me to make in ControlMap.
- Write evidence request notes to the "notes" field and assignees to "assigned_to".
- Files can't be uploaded through the MCP. Attach a link to where the file lives (SharePoint, Google Drive) and list any files I need to upload in ControlMap.
- Department and risk category must match existing values (GET /risks/departments and /risks/categories).
- Action item effort is capped at 8 hours, so put larger estimates in the description.
- A 500 error can still save part of a change. Read the record back before retrying.