Review and evidence

Review decisions records the reviewer’s Approve, Reject or Return choice, the decision time, reason, source revision and operation key under a parent assessment. It also links to the team members record for the reviewer. This gives the team more than a status label: it tells a later reader which version was considered and who made the call. The Independent Assurance Reviewer should write a reason that points to the issue or evidence considered, especially on a return or rejection.

The Control Owner prepares the assessment and its supporting records. The reviewer decides independently. The App Administrator manages membership but does not gain decision authority through administrative access. An Auditor reads assigned evidence and reports without editing the review. Keep these responsibilities clear when staff cover for one another during an absence.

• Decision record. The choice, source revision, reviewer, time and reason belong together under the assessment.
• Attachment trail. Files have a title, upload time, uploader, evidence type and visibility; the parent points back to the assessment.
• Review queue. Assessment status and revision help the reviewer select the work that is ready for a decision.

Define what a complete review package contains: a clear assessment subject, correct organization and counterparty, relevant dated checks, and the source files the reviewer needs. Decide when an attachment should be Shared rather than Internal. A file’s visibility determines who may see it, so the uploader should choose deliberately and test the result using an Auditor account.

Agree the response to an edited assessment after a decision. A changed amount, period or counterparty can alter the basis for approval. The source revision in the decision must still identify the version that was actually reviewed. Record a fresh decision when the team needs one rather than silently carrying approval to a new revision. Define the business meaning of Return separately from Reject so owners know whether to correct the same record or stop the case.

An owner submits an assessment with a statement attachment and a dated test line. The Independent Assurance Reviewer opens the review queue, checks the current revision, inspects the linked file and writes Return with a reason because the evidence type was wrong. The owner corrects the record and submits a new revision. The reviewer then records Approve against that revision. An Auditor later sees both decisions, their dates and the attachment history under the same parent assessment. The prior return remains part of the case, rather than disappearing when the status changes.

• Assessments Awaiting Review — See the current subjects, owners, revisions and amounts ready for a decision.
• Shared Attachments — Read supporting files made visible for review.

Follow independent review to rehearse the decision and evidence and reconciliation to trace the supporting outcome.