A mock review is a one hour internal rehearsal where one person plays the customer's reviewer and asks for evidence behind your own answers. You will find stale documents, claims without proof and answers that contradict each other, while it is still cheap to fix them.
Why rehearse
Real reviews expose gaps at the worst moment: a deal is waiting and the owner of a document is on leave. A rehearsal moves that discovery earlier. It also trains the team to answer in the same words.
Roles
| Role | Job |
|---|---|
| Reviewer | Asks questions, requests evidence, scores answers |
| Respondent | Answers as the company would, with real documents |
| Scribe | Records gaps, owners and dates |
The reviewer should come from outside the team that wrote the answers, such as an engineer from another group or a colleague from finance who reads critically.
Prepare the pack
- Pick the last real questionnaire or a standard short form.
- Select twenty answers, mixing yes answers, partial ones and any gap statements.
- Give the reviewer the answers but not the evidence folder.
- Book one hour and tell everyone the purpose is finding gaps, not blame.
Run the hour
- The reviewer picks an answer and asks, "Show me."
- The respondent opens the evidence. The scribe notes the time taken.
- The reviewer scores it using the sheet below.
- Repeat for twenty answers. Stop at the hour even if the list is unfinished.
Scoring sheet
| Score | Meaning |
|---|---|
| 3 | Evidence found in under two minutes, current, matches the answer |
| 2 | Evidence found but old, partial or slow to find |
| 1 | Evidence exists but does not support the wording |
| 0 | No evidence |
Anything scored 0 or 1 is an overclaim. Change the answer or produce the evidence.
After the session
Within two days, list each gap with an owner and a date, and add them to the commitments register. Update the answer library with the corrected wording. Rerun the exercise on the items scored 0 or 1 within a month.
Track two simple figures over time: the share of answers scoring 3, and the median time to find evidence. Do not publish them to customers; they are internal measures of readiness. The goal is for the evidence folder to be so well organised that anyone can find a record quickly.
Typical findings
- A policy with a review date more than a year old.
- A screenshot with no date or source.
- An answer that says quarterly where the record shows yearly.
- An owner who left the company.
- A claim that came from a marketing page, with no evidence at all.
Fixing these before a customer sees them is the entire value of the exercise. Run one before any large deal, after major product changes and at least once a year.
Where Safeguard fits
Safeguard's compliance and evidence automation keeps evidence dated and linked to controls, which makes the find it in two minutes score easier to reach. You can try the free scan at https://gold.safeguard.sh/scan.
Quick check
Who should play the reviewer?
Someone outside the team that wrote the answers, who will ask for proof rather than accept explanations.
How often should we rehearse?
Before large deals, after big changes, and at least yearly.
Last reviewed: 19 October 2026.
