Review and evidence

A review decision belongs to an assessment and names its reviewer. It records the decision, reason, decision time and source revision. The operation key identifies the obligation under review so the team can distinguish decisions when an assessment contains several obligations. The source revision identifies the version examined. A record attachment also belongs to an assessment, has an uploader and carries a visibility choice for supporting material.

Operation receipts answer another question. They identify an action, expected revision, time and result state for work against an assessment. If an action fails or needs review, the reason and effect references help the Compliance Lead investigate. A receipt marked completed should correspond to the local effects the team expects to find.

• Decision. The Independent Reviewer records approval, rejection or return with a reason and source revision.
• Evidence. Authorized team members attach supporting material to the assessment and set its visibility.
• Outcome. The Compliance Lead examines failed or pending operation receipts before treating work as complete.

Decide which evidence belongs in an assessment attachment and which belongs in the organization’s document repository. Set clear rules for Internal and Shared visibility. A Shared label needs an agreed audience before the team uploads sensitive material. Confirm who can open a file and who may change a record’s visibility after review.

Agree what a reviewer’s reason must explain. An approval should identify why the submitted version is acceptable; a return should tell the preparer what to correct. Agree how the review operation key identifies one obligation and how the reviewer compares its source revision with the current obligation. Keep that key stable for a repeated action so the team can reconcile the receipt with the intended local effects.

Use an assessment with a submitted obligation and an attachment. Ask the Independent Reviewer to inspect the source details and the attachment under the intended visibility. Record a decision with a reason, an operation key identifying the obligation and the submitted revision. Then change the obligation in a controlled rehearsal and use the key and revision to find the version the reviewer examined.

Next examine an operation receipt for the assessment. Compare the action and expected revision with the actual records it should affect. If the receipt says Failed or needs review, the lead should see the failure reason and avoid describing the action as complete. The Operations Overview gives a starting point for pending decisions and failed operations, while the failed operations view focuses the reconciliation work.

• Failed operations — Actions marked failed or needing review, with their reason and assessment.
• Obligation review queue — Submitted obligations awaiting a recorded decision.
• Operations Overview — Tests performed, failed tests, pending review decisions and failed operations for the authorized scope.

See obligation review and assessment cycle.