What's the most common form of compliance theater you see? For consultants / auditors / security leaders: Not asking to bash anyone. Genuinely curious what behaviors make you think a company wants the badge more than the operating model. Could be tools, policies, evidence rituals, rushed audits, ownership gaps, whatever you see most.