Review and evidence

A review decision records the assessment, source revision, reviewer, decision, date, reason and operation key. This lets the team explain why a specific revision was approved, rejected or returned. An attachment records title, type, upload time, uploader and visibility. The team can use those details to assemble the evidence packet for a reviewer without confusing internal material with material marked shared.

An operation receipt records an action, expected revision, result state, time and any failure reason. It gives reviewers a way to distinguish a completed operation from one that failed or needs review. The receipt does not replace the underlying decision or source evidence; it points the team toward the record and revision that require attention.

• Record the decision. Keep the reviewer, source revision, decision date and reason on the assessment decision.
• Control visibility. Attach source material to the assessment and mark who may share it.
• Reconcile operations. Use the receipt’s expected revision and result state to investigate uncertain effects.

Agree what belongs in a shared attachment and what stays internal. Name the Independent Assurance Reviewer who can decide an assessment revision, and define how a changed revision returns to the Control Owner. Choose an operation key that the team can use to find its receipt. Assign someone to investigate receipts marked failed or needing review before the assessment is treated as settled.

Attach one internal item and one shared item to an assessment. Have the Independent Assurance Reviewer record a decision with a reason against the current assessment revision, then change that revision. Ask the Auditor to identify which version the decision covered. Create a receipt that needs review and have the reviewer compare its expected revision and failure reason with the assessment. Check access with a team member from another organization before opening either attachment.

• Receipts needing review — Inspect operations needing review against the expected revision.
• Shared assessment evidence — Find attachments available to the authorized reviewer.

During the pilot, include one attachment marked internal and one marked shared. Confirm who can open each file, then ask the auditor to follow the final decision to its source revision. Also rehearse a receipt that needs review, including its failure reason, so an uncertain operation does not look like a completed one.

See the related process and the record model before agreeing the pilot.