“You’ve built your resilience plan on a ghost,” Priya said quietly. “If you’d bought the real standard, you’d have seen the warning on page one: ‘This draft is for committee review only. Do not use for implementation.’”

“The latest,” Arun said, sweating.

In the low-lit clutter of his basement office, Arun typed the same phrase he’d been chasing for three weeks:

“Based on which version of the standard?” Priya asked.

She pulled up her licensed copy. Side by side, the differences were glaring. His “free” draft had omitted an entire subsection on supply chain mapping —exactly the clause their contract required. Worse, the draft’s outdated annex recommended a risk matrix method that had been deprecated for three years.

The client’s resilience lead, a sharp-eyed woman named Priya, asked to see their documented alignment with Clause 6.3— “Communication of resilience policy to all workers.” Arun’s team proudly showed their internal memo.

The download was instantaneous: a scanned PDF, watermarked with a faded “DRAFT – NOT FOR IMPLEMENTATION.” But it looked official enough. He emailed it to his team with the subject line: “BS 65000 – got it. Use for gap analysis.” Two weeks later, the audit came.