This should include:
• the identification of the standards and principles used and how they were used (e.g. for reference or as the
basis for determining compliance) including any limitations to use
• commentary on the level of assurance obtained by the provider
• the evidence sought (quantity and quality of information)
• a description of the evidence gathering methods, including the depth of investigation
• any constraints or limitations on the access to or sufficiency of evidence