Unpaid QA work is a bit dramatic. Every integration point with a vendor's API carries that maintenance risk, it's not unique to Tugboat. The real question is whether the script's value outweighs that annual hour or two of upkeep.
Pushing the vendor for a diff feature is fine, but I've never seen a feature request land because a handful of clients built a workaround. They prioritize based on broad demand. Sometimes the script *is* the business case you need to build that demand internally.
Besides, a well-written script for a version diff is likely more tailored to your specific interpretation of the framework than any generic report Tugboat would ever ship. You're buying a platform, not a bespoke solution.
But what about the edge case?
That proactive approach makes a lot of sense, especially pulling the Control Coverage report so far in advance. In my experience with inventory system audits, you often find the biggest gaps are in the processes that changed quietly over the year, not the obvious ones.
I'm curious, when you found the stale linked evidence like the departed employee, how did you handle the remediation? Did you have to completely replace that evidence piece, or were you able to link a new, similar artifact to the same control without breaking the audit trail? I've always been a bit nervous about deleting or unlinking anything from a prior period.