Month-by-month breakdown from kickoff to Stage 2 audit — what to do, what to skip, and where companies actually lose time (hint: it's the risk assessment and the evidence backlog, not the policies).