Nine-Phase Audit Playbook

Preflight

1. Complete the scope contract.
2. Resolve the organization, executive, and region.
3. Identify applicable privacy, outreach, and source-use rules.
4. Set passive-only as the default authorization.
5. Choose audit mode and time box.
6. Create source, claim, calculation, opportunity, and contact ledgers.
7. Define the three decisions the audit must improve.

Phase 1 — Technical and passive OSINT fingerprint

Questions

• What official domains, subdomains, certificates, public services, repositories, documents, vendors, and technology signals are observable?
• Which signals indicate complexity, aging, inconsistency, or missing controls without requiring active testing?
• Which findings are verified facts, passive hints, or unknown?
• What business outcome could the technical condition affect?

Collection lanes

1. official domains, DNS, RDAP/WHOIS and certificate transparency;
2. passive technology fingerprinting and historical snapshots;
3. public status, security, privacy, trust, API and developer pages;
4. public repositories and dependency manifests;
5. public documents and metadata, collected under source terms;
6. authorized breach-notification/domain-monitoring sources;
7. executive speeches, filings, posts, interviews, board and association biographies.

Required controls

• No port scanning, directory brute force, authentication attempts, exploit checks, or payloads.
• Do not infer MFA status.
• Do not collect credential material.
• Treat version fingerprints as unverified until corroborated.
• Separate target-owned assets from third-party/CDN/shared infrastructure.

Deliverables

• asset and dependency map;
• technical-change timeline;
• evidence-safe risk register;
• business-mechanism hypotheses;
• private responsible-disclosure route for material security signals.

Phase 2 — PR, brand sentiment, and reputation

Questions

• What themes recur, where, and over what window?
• Is the company responding? How quickly and consistently?
• Which narratives are customer misunderstandings, service failures, contested claims, or information gaps?
• Who owns share of voice by topic and outlet tier?

Method

1. declare sources, window, queries, languages, and sample denominator;
2. collect platform-permitted records and RSS/news indexes;
3. normalize entity, topic, stance target, sentiment, engagement, and response;
4. deduplicate syndication and copied posts;
5. human-code a stratified sample to test the classifier;
6. compare target and competitors using identical rules;
7. map narrative propagation using the fourteen change variables.

Deliverables

• topic-by-source sentiment table;
• complaint/response matrix;
• earned-media and SOV benchmark;
• narrative risk/opportunity map;
• crisis-information gaps.

Phase 3 — Marketing, advertising, and audience engagement

Questions

• What current creatives, promises, proof, formats, offers, and calls to action are visible?
• Where is high-intent demand not matched by a relevant page, ad, answer, or offer?
• Where does the journey lose clarity, trust, performance, accessibility, or message match?
• Which gaps are observable and which require internal analytics?

Method

1. inspect official ad-transparency libraries manually or through permitted interfaces;
2. inventory target and competitor content over an equivalent window;
3. group search demand into problems, comparisons, alternatives, costs, risk, implementation, and local intent;
4. map each topic to journey stage and existing asset;
5. test public pages for performance, accessibility, structured data, indexability, and broken flows without submitting forms;
6. identify missing measurements that prevent CAC/conversion conclusions.

Deliverables

• creative/message matrix;
• content velocity and topic-coverage matrix;
• demand-to-asset gap map;
• journey friction register;
• measurement plan.

Phase 4 — Overlooked opportunities and blind spots

Stakeholder × Job × Journey × Channel × Format × Offer × Geography × Time
× Ownership × Feedback × Five change states

Candidate families:

• unused owned/earned/paid/partner channels;
• under-monetized audiences, content, data, proof, expertise, integrations, or locations;
• missing follow-up, activation, expansion, referral, or win-back loops;
• regional listings, associations, events, awards, trade media, and co-marketing;
• operational assets that can become a productized diagnostic or trust signal;
• a new unit of value that creates a C4 demand curve.

Rank three levers for the executive brief, but preserve the full option register.

Phase 5 — Microeconomic and unit-economic analysis

Unit definition

Name the unit before calculating: lead, qualified opportunity, new customer, active account, order, project, seat, transaction, service ticket, location, or retained customer.

Questions

• What price and packaging are public? What is genuinely comparable?
• Where might willingness-to-pay differ by segment or use case?
• Which manual or vendor-dependent steps raise marginal cost?
• Where might acquisition, activation, churn, support, or expansion leak contribution margin?
• What capacity constraint makes the next unit more expensive or slower?

Required outputs

• unit-economics tree;
• public pricing comparison with scope/feature normalization;
• operational-friction hypotheses;
• LTV/CAC model template with missing inputs;
• low/base/high scenario ranges.

Private-company economics usually remain hypotheses until the target supplies volume, margin, conversion, churn, and labor data.

Phase 6 — Competitor benchmark and gap analysis

1. select up to three comparable organizations with reasons, using fewer when comparability fails;
2. freeze a common window, geography, customer, and offer class;
3. compare facts separately from proxies;
4. normalize features, price units, content counts, outlets, reviews, and delivery claims;
5. identify target advantage, parity, disadvantage, and unknown;
6. find whitespace—not just missing features.

Required dimensions:

• technology and delivery;
• offer, packaging, price and proof;
• discovery/content/ad presence;
• media SOV and narrative ownership;
• customer experience and response;
• operating/economic proxies;
• strategic trajectory across five LAKA change states.

Phase 7 — Macro and industry mapping

For each driver record:

Driver → exposure path → affected unit → direction → magnitude range
→ lag → leading indicator → management lever → source

Driver families:

• interest rates and credit;
• inflation, wages, productivity and labor availability;
• currency, trade, shipping, input costs and supply concentration;
• regulation, privacy, accessibility, security, sector rules and deadlines;
• demographic, geographic, technology and demand shifts;
• platform/API/policy dependencies;
• climate/energy exposure where material.

Use primary statistical and regulatory sources. Do not turn national averages into company-specific impact without an exposure mechanism.

Phase 8 — Financial impact and dollar metrics

For every proposed number:

1. identify observed/reported/measured/benchmark/assumed inputs;
2. state formula and unit;
3. calculate low/base/high;
4. apply attribution and realization factors;
5. state time-to-value, one-time cost, recurring cost, and risk;
6. test overlap with other gaps to prevent double counting;
7. show sensitivity and break-even;
8. label scenario vs target-reported fact.

The matrix includes not estimable when appropriate. It is better than a fabricated dollar value.

Phase 9 — Executive pitch and CRM output

Pitch selection

Choose findings that score high on:

• evidence strength;
• relevance to the executive's public business remit;
• economic mechanism clarity;
• service fit;
• novelty without creepiness;
• reversible next step;
• low legal/reputation risk.

CRM record

Use published business contact details or pattern-only/unknown status. Resolve identities, deduplicate companies and people, sanitize CSV cells, and preserve provenance and lawful-use basis.

Human approval

Before outbound use, a reviewer confirms:

• correct company and person;
• current title;
• finding and source accuracy;
• no sensitive security or personal detail;
• no misleading subject line or certainty;
• applicable consent/identification/unsubscribe requirements;
• suppression and opt-out lists;
• appropriate send volume and channel.

Final synthesis

The report contains seven user-facing sections:

1. Executive briefing and OSINT digest
2. Marketing, PR and overlooked opportunities
3. Micro- and macroeconomic diagnostic
4. Competitor benchmark
5. Financial impact matrix
6. C-suite outreach blueprint
7. CRM import table

Appendices contain the evidence ledger, calculations, tool/source registry, full alternatives, limitations, and research backlog.

---

04-nine-phase-playbook.md · 244 lines · 9029 bytes · SHA-256 8a6e44e7ee25f438