01 · ENGAGEMENT AUTHORITY
“We did a ROC last year.”
ASSERTED · FICTIONAL DEMO
The kickoff brief says “repeat last year’s ROC.”
FICTIONAL CASE · FIVE FACTS · NO READINESS SCORE
The kickoff is booked. Is the assessment ready?
A date on the calendar does not reconcile the mandate, payment story, system population, operating owners, or history. Choose a mismatch below and see what question it raises—and what it does not prove.
100% ready ≠ 100% compliantReadiness means the work can start from an honest, bounded set of facts. It is not an assessment conclusion or a promise of a clean report.
THE FICTIONAL ENTITY · NORTHSTAR OUTFITTERS
Five kickoff claims. Five places to ask for the facts.
Northstar accepts card payments online. Its kickoff is next Monday. Nothing below is a real organization, evidence record, or assessment result.
ASSESSMENTMONDAYthe facts are not ready on a calendar
01Customerbrowser
→02Hosted checkoutprovider
→03 · NOT ON DIAGRAMPayment callbackmerchant order API
→04Order servicemerchant cloud
No score. No green badge. No “compliant” button.The exercise helps you find the next question; it cannot decide scope, applicability, control effectiveness, or assessment disposition.