A review brief
We define what the review needs to establish, who will use the findings and which systems are in scope. We also record access limits and known gaps in the evidence. This prevents a broad request to audit everything from becoming a report that misses the decision you actually need to make.