Define the scope
Choose employer or education sponsorship first. Record the legal entity, licensed sites, routes, relevant teams and review period. Make a list of systems and hand-offs before selecting files.
- Document which controls apply and why any control is excluded.
- Include people who handle recruitment, admissions, HR, payroll, teaching, safeguarding and SMS, as relevant.
- Preserve the date and version of the guidance used for the review.
Choose a defensible sample
Combine a spread of routine files with risk-focused cases. Consider starters, leavers, role or course changes, absences, location changes, expiring permissions and reporting events. A small clean sample does not prove the whole population is compliant.
Record the population, how the sample was chosen, what was excluded and the reasons. Expand the review when an issue may be systemic.
Test controls against evidence
For each control, inspect the underlying record and ask the responsible person to demonstrate the process. Compare what the policy says with what the system and case chronology show.
The toolkit uses evidence-backed answers. Missing information stays unresolved; a critical gap takes priority over a favourable overall percentage. These are internal readiness indicators, separate from official UKVI ratings.
Write useful findings
Each finding should identify the observed facts, source requirement or control expectation, affected population, risk, corrective action, owner and target date. Separate a confirmed breach from an incomplete record or an issue needing specialist interpretation.
Keep necessary personal evidence in your organisation’s controlled systems. Use aliases and evidence references in the browser workbench.
Close the loop
Check that the remedy is working, not merely that a policy was rewritten. Re-sample affected files, record the reviewer and closure evidence, and decide whether training, a wider review or senior escalation is needed.