Confirm what the auditor is being asked to examine
Record the site or sites, activities, criteria, period and exclusions. Ask whether the review includes interviews, observation, document sampling or follow-up. A broad request to “check compliance” leaves different parties assuming different deliverables.
Build an index before sending files
For each agreed topic, list the document or record, version/date, owner and access location. Mark a missing item as missing; do not replace it with an unrelated template. Keep confidential records in the agreed controlled channel. The public enquiry needs a description of what exists, not a full personnel or incident archive.
Illustrative preparation gap
A site has an action list labelled complete, but the evidence folder contains only purchase orders. Record that mismatch in the preparation index: a purchase order may show an intended acquisition without proving installation or effective use. The responsible person can explain what further evidence is available; the auditor decides how it relates to the criteria.
Arrange the practical review
Name a coordinator, agree site access and make people familiar with the relevant work available. Identify shift or shutdown constraints before setting the agenda. After the review, preserve the findings and agree how responses and verification will be managed; organising evidence in advance is not itself a compliance verdict.
Put the decision into practice
- 1Agree scope and criteria.
- 2Index evidence with its date, owner and status.
- 3Arrange controlled access and relevant interviews.
- 4Record missing items and their expected availability.
- 5Agree the route for findings and follow-up.