The completed assessment checklist is retained as the detailed record of which requirements were assessed, what evidence was examined, and what conclusion was reached for each. The checklist provides granular traceability that the Assessment Report summarises.

A competent authority conducting a targeted review of a specific Article (for example, Article 10 data governance) should be able to locate the relevant checklist items and follow the trail to the underlying evidence without needing to read the entire Assessment Report.

Key outputs

• Completed per-requirement checklist with evidence and determinations
• Granular traceability for targeted review
• Ten-year retention
• All 12 modules covered