Hands-On: Compliance Audit Preparation

#!/usr/bin/env python3
# Pre-assessment readiness checker — run 4 weeks before FSA/ASPICE assessment
import requests, json

COMPLIANCE_MATRIX_FILE = "compliance_matrix_iso26262.json"

def check_evidence_links(matrix_file):
    with open(matrix_file) as f:
        matrix = json.load(f)

    broken = []; incomplete = []; ok = 0
    for req in matrix["requirements"]:
        if req["status"] in ["Unknown", ""]:
            incomplete.append(req["id"])
        elif req["evidence_url"]:
            resp = requests.head(req["evidence_url"], timeout=10)
            if resp.status_code != 200:
                broken.append((req["id"], req["evidence_url"], resp.status_code))
            else:
                ok += 1

    print(f"Evidence links: {ok} OK, {len(broken)} broken, {len(incomplete)} incomplete")
    for req_id, url, code in broken:
        print(f"  BROKEN [{req_id}]: {url} → HTTP {code}")
    for req_id in incomplete:
        print(f"  INCOMPLETE [{req_id}]: No status or evidence — classify or complete")

    return len(broken) == 0 and len(incomplete) == 0

def check_process_owners_briefed(roles):
    print("\nProcess owner briefing status:")
    for role, briefed in roles.items():
        status = "READY" if briefed else "NOT BRIEFED"
        print(f"  {role}: {status}")
    return all(roles.values())

# Execute pre-assessment checks
roles = {
    "SWE.1 Requirements Engineer": True,
    "SWE.4 Test Engineer":         True,
    "SUP.8 CM Engineer":           False,  # needs briefing
    "Safety Manager":              True,
}

links_ok = check_evidence_links(COMPLIANCE_MATRIX_FILE)
owners_ok = check_process_owners_briefed(roles)

print(f"\nOverall readiness: {'READY' if links_ok and owners_ok else 'NOT READY — fix above gaps'}") 

#!/usr/bin/env python3
# Post-audit finding tracker: Major/Minor classification with action plans
from datetime import date, timedelta

findings = [
    {
        "id": "AF-2026-001",
        "type": "Major",
        "standard": "ASPICE SWE.4 (Level 2 GP 2.1.7)",
        "description": "Unit test process does not manage stakeholder interfaces "
                       "(test results not formally communicated to Safety Manager)",
        "root_cause": "GP 2.1.7 (manage stakeholder interfaces) not understood as applicable to testing process",
        "action": "Add Test Report distribution step to test process; Safety Manager on test report distribution list",
        "owner": "Test Process Owner",
        "target_date": str(date.today() + timedelta(days=30)),
        "follow_up_assessment": True,
        "status": "In Progress",
    },
    {
        "id": "AF-2026-002",
        "type": "Minor",
        "standard": "ISO 26262-6 §9 (MISRA)",
        "description": "3 MISRA C:2012 advisory violations in non-safety partition accepted without documented justification",
        "root_cause": "Deviation process not followed for advisory violations",
        "action": "Add justification comments per MISRA deviation process; update static analysis suppression policy",
        "owner": "Lead SW Engineer",
        "target_date": str(date.today() + timedelta(days=90)),
        "follow_up_assessment": False,
        "status": "Planned",
    },
]

for f in findings:
    days = (date.fromisoformat(f["target_date"]) - date.today()).days
    print(f"[{f['id']}] {f['type']} — {f['standard']}")
    print(f"  Finding: {f['description'][:80]}")
    print(f"  Action:  {f['action'][:80]}")
    print(f"  Owner: {f['owner']} | Due: {f['target_date']} ({days}d) | Status: {f['status']}")
    if f["follow_up_assessment"]:
        print(f"  ⚠️  Follow-up assessment required within 30 days for Major finding")
    print()