Three stories of consent rebuilds, audits, and GDPR work run as engineering discipline, where scrutiny is a lever rather than a threat.
For readers who carry a governance budget and fear it will only ever be overhead: the case that compliance work is a capability to build and amortize, carried by a single-product consent rebuild that passed a real control and a group-wide GDPR rollout met on time.
A free consent manager nobody had scoped to fix had drifted out of CNIL compliance on a regularly inspected site. This walks the solo rebuild across eight locales, and the real control six months after deployment that raised no requirements or problems.
Argue that taking an external audit on as a system improves the operation, evidenced by three real controls where scrutiny was absorbed and documentation came out stronger, and scoped honestly: the claim is that scrutiny strengthens the accountable operation, not that every control is good.
