Define what the review is testing
- Set the process, locations, period and criteria before gathering evidence.
- Use dated inspection, compliance, incident and corrective-action records to support each conclusion.
- Distinguish a missing record from evidence that a control failed; they require different findings.