Q&R audit schedule — recurring assurance cadence

Owner: Quality & Risk (Quality & Risk Director). Layer: Operating doc (reports/). What Q&R audits and when. Caveat: cadence automation is a no-op (AR-003; risk R-004) — until wired, every entry below is run manually at the relevant wave checkpoint; the PMO records the result in tracker.md (master plan §11 R6 / §12). This is a stub seeded at Wave 3; it fills as cycles run.

Standing cadence

Cadence	What	Procedure	Run mode (today)
Each wave checkpoint	Four-test stratified sample on the just-completed wave (anti-theater gate; R1/R11)	SOP-087	manual (no shell → gates logic-traced + Operations/PMO machine-attest)
Each cycle	Control-gap follow-up — re-confirm every open row in the control-gap registry	SOP-085 + SOP-086	manual
On any new High/Critical	Open/update the risk register row; notify Principal/affected Lead; recompute posture	SOP-086	manual
Quarterly	Policy-conformance audit (“are we following our SOPs / HR policies”)	SOP-085	manual (deferred until a cycle’s worth of practice exists to audit)

Open commitments (carry-forward)

Wave-1/2 control gaps — confirm closure at the next cycle (see the control-gap registry in reports/risk-register.md: G-W1-1, G-W1-2, G-W2-1…4).
R-001 (Slack ToS) — confirm the deletion cron stays disabled at each Wave-3 checkpoint until the migrations + fallback job ship.
R-003 (fan-in blind spot) — re-assess when Operations lands a producer-presence CI complement.

See also: docs/units/quality-risk/charter.md · reports/risk-register.md · SOP-085 / SOP-086 / SOP-087 · master plan §11 / §12.