Master Clause 4.4: map processes, build turtle diagrams, set KPIs, manage risk, and audit by process not department