Reproducible witness bundle for audit evidence

What the witness bundle contains

The bundle is designed for independent verification. Your internal audit team, external auditors, or a third-party reviewer can trace a finding in the compliance report back to the capture that supports it — without scheduling another consulting engagement.

• Per-vendor source captures from read-only management API access, preserved as raw responses so reviewers can audit how MKDC normalized them
• A cross-tier validation log recording which dependency checks passed, which were partial, and which failed or need human follow-up
• Framework reports, an audit-committee posture summary, and a remediation worklist, all generated from the same capture
• An integrity manifest with the SHA-256 of every file and the sources each published conclusion was derived from

Why reproducibility matters to audit committees

Audit committees are asked to defend DR and compliance readiness with evidence, not narrative. When documentation cannot be reproduced from source data, the committee inherits model risk — they are approving conclusions they cannot independently validate.

Manual consulting deliverables rarely include a reproducible trail. PowerPoint decks and spreadsheets describe outcomes; they do not package the captures, normalization steps, and validation checks that produced those outcomes. Findings decay before the next cycle.

How MKDC produces the bundle

Read-only API capture from management planes records hypervisor, network, storage, and OOB state. MKDC normalizes vendor-specific outputs into one model, validates dependencies end-to-end, and generates RTO/RPO matrix and prioritized DR gap analysis, recovery runbooks, and automated compliance reports with per-framework gap analysis from that single pass.

Splitting discovery, recovery, and compliance across separate vendors or engagements would produce inconsistent artifacts — runbooks disconnected from the dependency map, compliance gaps without estate evidence. One witness bundle preserves coherence.

Independent verification without re-engaging MKDC

Advisory, not formal attestation. The bundle ships with every engagement: Fixed fee · 4–6 weeks.

• Third parties can re-derive conclusions from packaged evidence
• Integrity manifest detects tampering or accidental drift
• Source captures preserved for the examination period defined in your SOW
• Advisory documentation — not formal attestation or auditor substitution

What your auditor does with the bundle:

1. Checks file hashes against the integrity manifest to confirm nothing changed after delivery.
2. Picks a finding in a framework report and follows its evidence pointer to the source capture.
3. Re-derives the conclusion from the capture and validation log, without MKDC on the call.
4. Records the re-performance in their own workpapers, as with any other evidence.

How committees use the bundle in review

The bundle is structured for oversight — not for day-to-day operations. Operations teams still run production; the witness bundle is the evidence layer audit committees and regulators sample when they ask whether documentation matches reality.

• Trace a compliance gap status to the capture and validation step that supports it
• Confirm recovery runbook steps reference inventory from the same capture date
• Share packaged evidence with external auditors without re-engaging MKDC for every follow-up
• Compare current-cycle capture to prior cycle when repeat findings are a concern
• Satisfy internal audit requests for independent re-derivation of conclusions

Relationship to compliance gap analysis

Every compliance finding in an MKDC report should point into the witness bundle — a gap status without an evidence pointer is incomplete for committee review. The bundle is the substrate; gap analysis, runbooks, and executive summary are the views auditors and committees read.

When multiple frameworks apply, one bundle supports FFIEC, SOC 2, SOX, HIPAA, or HHS 405(d) subset mapping as scoped in your SOW. Splitting bundles across vendors reintroduces the inconsistency problem the witness bundle is designed to eliminate.

Integrity and retention expectations

The integrity manifest lets reviewers confirm deliverables were not altered after publication. Retention period and scope boundaries are defined in your statement of work — sized to the examination window and framework subset you sponsor.

Internal audit teams use the bundle for re-performance without MKDC present: open a gap finding, follow the evidence pointer, inspect the source capture and validation log, and re-derive the published conclusion. That workflow is the practical definition of reproducible witness-bundle evidence.

See sample outputs

The sample bundle and evidence chain on this page are illustrative — they show format and evidence pointers, not customer data. The homepage adds redacted estate snapshot and compliance gap excerpts styled as deliverable mocks.

Request an intro to discuss how the witness bundle is scoped for your frameworks, examination window, and data center estate.

Sponsors often ask whether internal audit can verify the bundle without MKDC on the call. Yes — that is the design intent. The integrity manifest and evidence pointers exist so third-party re-derivation does not require vendor participation.

The witness bundle is not a substitute for formal attestation or auditor judgment. It is the evidence substrate that makes advisory DR and compliance documentation defensible when committees and examiners ask for proof.