Review and evidence

A review decision belongs to an assessment and records the source revision, reviewer, outcome, date, reason and operation key. That makes the decision more precise than a status change alone. The Independent Assurance Reviewer can approve, reject or return a revision with a written reason. The Control Owner then knows whether the work may proceed or needs correction.

Attachments sit under the assessment with a title, evidence type, upload date and visibility. The uploader is named. An internal file and a shared file may serve different audiences, so access to each should follow the agreed evidence policy. An Auditor can review authorized decisions and files without taking over the Control Owner’s work.

• Decision. Preserve who decided, which revision they saw and why they approved or returned it.
• Attachment. Keep each file under its assessment with a named uploader and visibility setting.
• Receipt. Record the guarded operation, expected revision and resulting state for later reconciliation.

Define the circumstances that require independent review and the minimum reason for a returned decision. Agree whether evidence is internal or shared, who can change its visibility and how long the record is retained. Decide how an operation key is generated and what effect references the team expects to find before a receipt is marked completed.

A receipt can be pending, completed, failed or in need of review. Reconciliation starts by comparing persisted effects to the expected operation. If they differ, the reviewer should inspect the failure reason and the parent assessment before closing the receipt. This protects the audit trail when a command is repeated or an external step is uncertain.

The Control Owner submits an assessment revision with its attachments. The Independent Assurance Reviewer opens the review queue, checks the file and test record, then records an approval or return with a reason. A related policy version can then receive its own decision. The operation receipt records the action and expected revision. During completion review, the reviewer compares that receipt with the actual records created or changed.

If the expected effect is missing, the receipt remains for investigation. The earlier reviewer decision and attachments remain available so the team can explain what was intended and what actually happened.

• Receipts needing review — Guarded operations that need a closer comparison with persisted effects.
• Review queue — Assessment revisions awaiting an independent decision.
• Policy decision queue — Submitted policy versions awaiting a decision.

See independent review, policy review and completion reconciliation.