A crosswalk is a claim, not evidence
A coverage report can look finished. Every requirement across four frameworks has a control mapped to it, color-coded, ready to export. Then an auditor asks the one question that decides anything: for this requirement, show me the control operated over the period, and show me the evidence. The mapping cannot answer that. It was never built to.