This guide shows real-world R2v3 nonconformities that recyclers and ITAD providers run into, why they happen, and exactly how to correct and prevent them. Use the checklists, templates, and acceptance criteria to close findings quickly and keep them from coming back.

---

How to read this playbook

• Scope: Focuses on operational pain points that commonly trigger minor and major nonconformities during Stage 1, Stage 2, and surveillance audits.
• Format: Each section lists (1) what auditors usually find, (2) the root causes, and (3) corrective and preventive actions with evidence examples and acceptance criteria.
• Use it: Copy the bullet points into your CAPA form and attach the evidence listed.

---

1) Data security & sanitization: method not matching media, or records incomplete

What auditors find

• Drives or devices labeled “wiped” without a verifiable record of method, tool, settings, pass/fail, and unique identifier.
• Mixed media types treated with a single method that isn’t appropriate (e.g., SSDs processed with an HDD-only overwrite method).
• Sampling performed, but the sampling plan isn’t defined or justified.
• Software version or wipe profile changed mid-period without a change control entry.

Likely root causes

• SOPs are vague or not role-specific.
• Technicians rely on tribal knowledge; training records do not reflect method specifics.
• Wipe tool exports not mapped to your log fields; serial capturing inconsistent.

Corrective actions (fix now)

• Align each media type to an approved method in a one-page Media → Method Matrix and post it at the station.
• Update the Data Sanitization Log to include: asset ID, media type, tool & version, profile, date/time, operator, pass/fail report reference, and reviewer sign-off.
• Re-run sanitization for a sample of affected items; quarantine and reprocess any uncertain units.
• Record a change control entry for the tool/version/profile currently in use.

Preventive actions (stop it recurring)

• Technician training module that covers the matrix and log completion; require practical sign-off.
• Weekly sanitization spot-check: supervisor reviews 10 random records against exported tool reports.
• Lock the wipe tool configuration; changes require manager approval with a version snapshot.

Evidence to attach

• Updated SOP and the Media → Method Matrix.
• Completed logs with matching software reports.
• Training sign-in and competency checklists.
• Spot-check checklist with pass rate.

Acceptance criteria

• For a sample of 30 wiped devices across media types, 100% have full, traceable records and correct method per matrix; 0 unlabeled or unverified devices on the floor.

---

2) Chain of custody: gaps between intake, storage, and outbound transfer

What auditors find

• Intake receipts exist, but location status and container IDs aren’t tracked end-to-end.
• Outbound shipments lack a complete reconciliation from intake quantities/IDs to final disposition.
• “Quarantine” or “secure cage” exists, but no log shows time-in/time-out and who had access.

Likely root causes

• Process maps stop at departmental boundaries.
• Labels or barcodes not applied at the first practical touchpoint.
• Paper forms that don’t sync with the digital ledger.

Corrective actions

• Introduce a Chain-of-Custody Ledger (physical or digital) with five mandatory states: Received → In Secure Storage → In Process → Post-Process Hold → Outbound.
• Require unique container IDs; affix labels immediately on intake.
• Perform a backward reconciliation on last quarter’s shipments: choose 3 representative POs and tie every unit/container to the outbound record; correct discrepancies.

Preventive actions

• Gate control: outbound cannot be scheduled unless reconciliation status = “complete.”
• Weekly walk-through with a location audit checklist (random containers).
• Integrate barcode scanning at intake and outbound to cut manual errors.

Evidence

• Completed ledger examples and reconciliations.
• Photos of container labels and secure storage signage.
• Walk-through checklists and corrective notes.

Acceptance criteria

• For 3 sample POs, 100% of items/containers are traceable from receipt to outbound with timestamps and handler IDs.

---

3) Downstream due diligence: approval packets incomplete or not refreshed

What auditors find

• Vendor approval forms on file, but missing waste codes, permit numbers, or final processing descriptions.
• Annual reviews overdue; risk ratings not updated after incidents or regulation changes.
• EHS/CSR claims (e.g., “no child labor,” “no prison labor”) not backed by documented checks.

Likely root causes

• DDQ template doesn’t reflect your actual outbound streams.
• Calendar reminders lapse; ownership for annual review unclear.
• Overreliance on marketing brochures rather than documented evidence.

Corrective actions

• Rework the DDQ to include: legal entity info, permits/licenses per stream, final process description, material flow map, facility photos, insurance, and contacts.
• Perform desk audits for top 5 highest-volume downstreams: gather missing docs, verify permit validity dates, and document risk scores.
• Temporarily suspend routing to any downstream lacking mandatory artifacts; identify alternates.

Preventive actions

• Annual review schedule with assigned owner; automated reminders 60/30/7 days before due.
• Post-incident re-evaluation trigger: any shipment complaint, nonconformity, or spill requires a DDQ refresh and risk rescore.
• Supplier scorecard with thresholds that auto-flag high risk.

Evidence

• Updated DDQ forms with attachments list.
• Annual review log and upcoming reminder plan.
• Risk scoring sheet with criteria and weighting.

Acceptance criteria

• 100% of active downstreams have current approval packets (dated within 12 months) that match your outbound streams and demonstrate legal authorization.

---

4) EHS controls: hazard assessments exist, but controls and training aren’t aligned

What auditors find

• Generic risk assessments written years ago; they don’t mention lithium batteries, toner dust, or noise exposure specific to your lines.
• PPE signage posted, yet training records don’t show task-specific PPE fit and use.
• Spill kits present, inspection logs missing or outdated.

Likely root causes

• Copy-paste assessments that never got localized.
• Training tracked by job title, not by task.
• No calendar for kit inspections or eyewash testing.

Corrective actions

• Update the Hazard Identification & Risk Assessment by process step (intake, demanufacturing, battery handling, shredding, packing). Add specific hazards and controls.
• Map each task to required PPE and training; issue task cards at workstations.
• Inspect and replenish spill kits; start a monthly inspection log.
• Conduct a drill (spill or fire) and document lessons learned.

Preventive actions

• Quarterly floor audit with an EHS checklist tied to the risk assessment.
• New-hire and job-change competency checks (not just attendance).
• Purchasing control: PPE or kit changes trigger SOP and training updates.

Evidence

• Revised risk assessment with sign-off date.
• Task cards, training matrix, and signed competency forms.
• Completed kit inspection logs and drill report.

Acceptance criteria

• Zero missing or expired EHS controls in a random walk-through; training matrix shows 100% of active operators with current task-specific training.

---

5) Testing, evaluation, and repair (reuse claims not evidenced)

What auditors find

• Units sold as “tested working,” but no test protocol or proof of test steps/criteria per device category.
• Repairs performed, but parts traceability and final quality check missing.
• Cosmetic grading inconsistent across technicians.

Likely root causes

• Test procedures live in people’s heads.
• Work orders don’t require attachment of test results or photos.
• No final QA gate before sale.

Corrective actions

• Create category-specific test sheets (e.g., laptops, desktops, monitors) with pass criteria, firmware/BIOS checks, and battery/cycle thresholds.
• Require a final QA sign-off on each work order before listing or shipment.
• Introduce a grading guide with photos and definitions for A/B/C; train staff.

Preventive actions

• Monthly QA sampling: pull 10 sold items, verify test sheets and grade accuracy.
• Calibration or version control for diagnostic tools.
• Separate “retest” lane for returned units.

Evidence

• Completed test sheets and work orders with QA sign-offs.
• Grading guide and training records.
• QA sampling log with results and actions.

Acceptance criteria

• For a sample of 20 sold units, 100% have complete test evidence; grading disputes under 2% over a quarter.

---

6) Document control & change management: people use the old version

What auditors find

• Multiple SOP versions on the floor; technicians follow an outdated instruction.
• Recent process change (e.g., new wipe profile) not documented or reviewed.
• Forms without revision numbers; difficult to verify they’re current.

Likely root causes

• Shared folders without permissions or archival rules.
• No “controlled copy” process for printed SOPs.
• Changes implemented informally and announced verbally.

Corrective actions

• Assign document owner per SOP. Add revision, effective date, and approval fields to the header.
• Implement controlled copies: stamped printouts with an expiry; remove/replace old prints during change rollout.
• Create a Change Control Log capturing reason, impacted docs, training required, and validation.

Preventive actions

• Quarterly document review calendar.
• Floor audit that checks version numbers against the master list.
• Rollout checklist: update docs, train, collect sign-offs, and pull obsolete copies.

Evidence

• Master document list with current revisions.
• Change Control Log entries and training sign-off sheets.
• Photos of controlled copies with issue stamps.

Acceptance criteria

• In a floor check of 10 stations, 0 obsolete documents present; all show current revision and effective date.

---

7) Incident/CAPA management: findings closed on paper, not in practice

What auditors find

• CAPA forms filled with generic “retrained staff” actions; no root cause analysis or effectiveness check.
• Repeat nonconformities across audits.
• Due dates keep slipping; ownership unclear.

Likely root causes

• CAPA template doesn’t force analysis.
• Teams avoid measuring outcomes (“did it work?”).
• Too many open CAPAs with no prioritization.

Corrective actions

• Use a 5-Whys + Containment/Correction/Corrective/Preventive CAPA form.
• Add effectiveness criteria before closing (e.g., error rate <1% for 60 days, verified via spot-checks).
• Limit WIP CAPAs; assign owner and due date; escalate overdue items weekly.

Preventive actions

• Monthly CAPA review meeting with metrics (opened, closed, repeat rates).
• Tie CAPA closure to evidence uploads and sign-off by someone independent of the process.
• Recognize teams that eliminate repeat issues; build a culture of prevention.

Evidence

• Completed CAPA forms with root cause analysis diagrams or notes.
• Effectiveness checks showing post-implementation performance.
• Meeting minutes and CAPA dashboard.

Acceptance criteria

• No repeat of the same nonconformity category in the next audit cycle; >90% CAPAs closed on time.

---

A simple, auditor-friendly CAPA template (copy/paste)

1. Nonconformity statement

• What requirement was not met?
• Where found (process, location, record)?
• Evidence observed (IDs, dates, samples)?

2. Immediate containment

• Action taken to protect data, safety, environment, and product today.

3. Correction

• Steps taken to fix the specific items found (rework, relabel, update records).

4. Root cause analysis

• 5 Whys summary or fishbone notes (People, Process, Tools, Materials, Environment).

5. Corrective action (stop recurrence)

• Specific procedural/technical changes, responsible person, due date.

6. Preventive action (stop similar risks)

• Broader systemic changes, training, audits, or controls.

7. Verification of implementation

• What evidence shows actions completed (files, photos, logs)?

8. Effectiveness check

• Metric, target, time window (e.g., 0 missed serials for 60 days; weekly sample of 20).

9. Approval & closure

• Reviewed by [name/title], date; next follow-up date.

---

Quick win checklist before your next audit

• Data sanitization: matrix posted, logs complete, weekly spot-checks done.
• Chain of custody: container IDs and state transitions recorded; 3 PO reconciliations on file.
• Downstream: 100% of active vendors have current approval packets; risk scores updated.
• EHS: task-based training current; spill kits inspected; drill in last 6 months.
• Testing & repair: category test sheets used; QA sign-offs present; grading guide trained.
• Document control: controlled copies only; change log current; obsolete docs removed.
• CAPA: template forces root cause and effectiveness; no overdue high-risk CAPAs.

---

Final notes

Auditors don’t expect perfection; they expect control. That means traceable records, clear ownership, and proof that your fixes work. If you use this playbook to structure your logs, training, DDQ packets, and CAPA forms, you’ll not only close today’s findings—you’ll reduce tomorrow’s risk.

Plain-English objective: R2v3 requires you to protect data at every stage—intake, handling, transport, processing, and final disposition—using documented controls that actually work. This guide gives you a practical, audit-ready workflow with sample SOP steps you can adapt immediately.

---

Scope & key definitions (keep these in your SOP)

• Data-bearing asset (DBA): Any device or component that can store data (HDD, SSD, NVMe, mobile, tablet, server, printer/MFP with storage, network gear with flash, DVR, point-of-sale, USB/SD, embedded controllers).
• Sanitization outcomes:
  • Clear: Overwrite data so it cannot be recovered using standard system functions and tools.
  • Purge: Render data unrecoverable using more rigorous techniques (e.g., cryptographic erase, firmware-assisted purge).
  • Destroy: Physically damage media so data is irretrievable (e.g., shredding, crushing, disintegration).
• Verification: Evidence that sanitization achieved the intended outcome (software report, hash check, sample QC, physical fragment size checks).
• Chain of custody (CoC): Continuous control and documented custody from pickup to final disposition.

Add these terms to your Definitions section so employees and auditors share the same language.

---

Roles & responsibilities (assign by job title)

• Intake Technician: Identifies data-bearing items at receipt, applies “DATA-BEARING” labels, triggers secure workflow.
• Data Security Lead (DSL): Owns the SOP, approves methods, maintains approved tool list, reviews exceptions.
• Sanitization Operator: Executes wipe/purge/destroy steps and records serials, method, outcome, and verification.
• QC Auditor: Independently verifies a defined sample or 100% where required; documents pass/fail.
• Logistics/Dispatch: Ensures secure transport, seals, custody logs, and storage area integrity.
• Compliance Manager: Performs internal audits, trend analysis, and CAPA for nonconformities.

Document this RACI in your procedure so it’s unambiguous who does what.

---

Intake-to-Disposition: the required control flow

Why this matters: Most nonconformities happen before or after the wipe—at intake (items missed) and after sanitization (mix-ups, incomplete records). A clean flow prevents both.

1. Pre-intake screening
   • Customer declares if assets are data-bearing; requests desired outcome (reuse with wipe, purge, or destroy).
   • Capture special handling requirements (e.g., encrypted assets, defective drives).
2. Secure intake
   • At receipt, visually and systematically identify DBAs. Use a laminated checklist by asset type.
   • Affix DATA-BEARING label and a unique asset ID. Photograph pallet/serial plates where feasible.
   • Record: customer, pickup manifest, seal numbers, time/date, handler signatures.
3. Controlled storage
   • Move DBAs to a restricted, CCTV-covered area with logged access.
   • Separate unsanitized from sanitized inventory with physical barriers and distinct tags.
4. Method selection (decision tree)
   • Intended reuse/resale: Prefer clear/purge; prohibit physical damage that harms reuse value.
   • High risk, encryption unknown, or device defective: Purge or destroy.
   • Customer-mandated destruction: Destroy regardless of device state.
   • Log the chosen method and rationale.
5. Sanitization execution
   • Use only approved tools/machines listed in your SOP (version-controlled).
   • Capture serial numbers, method, operator, start/end time, result code.
   • For cryptographic erase, record proof that the key was destroyed or reset performed.
6. Verification & QC
   • 100% verification for software-based wipe/purge (attach reports per device).
   • Statistical QC only where justified and documented (e.g., repeated identical media batches).
   • For physical destruction, verify fragment size against your acceptance criteria.
7. Exception handling
   • If a device fails wipe or tool aborts, quarantine and escalate to DSL.
   • Decide re-attempt with alternate method or destroy.
   • Record the exception, corrective action, and final outcome.
8. Final disposition
   • Mark assets as SANITIZED or DESTROYED with visible tagging.
   • Update inventory status; separate storage for post-sanitization goods.
   • Prepare Certificates of Sanitization/Destruction with traceability fields (see template below).
9. Outbound control & records retention
   • For remarketing: ensure no unsanitized DBAs are mixed into outgoing lots.
   • For scrap: ensure destroyed media stays in secure custody until it enters the shredder and is ground to spec.
   • Retain records for your defined retention period (commonly 3–7 years).

---

Sample SOP: Data Security & Sanitization (copy-adapt this)

Purpose
Ensure all data on received DBAs is secured and sanitized in compliance with R2v3 and customer requirements.

Scope
All DBAs handled at [Facility Name], including HDD, SSD/NVMe, mobile devices, printers/MFPs with storage, network devices, USB/SD, DVRs, and embedded flash.

Responsibilities
As listed in Roles & responsibilities above.

Procedure

1. Identification at Intake
   • Use the DBA Identification Checklist for each pallet/skid.
   • Tag suspected DBAs with red DATA-BEARING labels and assign Asset ID.
   • Photograph pallet and serial plates if accessible.
   • Log customer, time/date, receiver signature, and truck seal number.
2. Secure Storage (Pre-Sanitization)
   • Move DBAs to Cage A (restricted access). Log entry/exit in Cage Access Log.
   • Place into bins labeled UNSANITIZED ONLY.
3. Method Selection
   • Review customer instructions and device condition.
   • Select Clear, Purge, or Destroy per the Sanitization Decision Tree.
   • Record decision and operator initials in the Sanitization Work Order.
4. Execution – Clear/Purge
   • Connect device; verify serial in software UI.
   • Start approved wipe or crypto-erase profile.
   • On completion, export verification report; ensure it contains device ID, model, capacity, serial, method, date/time, and result.
   • If failed/aborted, quarantine and notify DSL.
5. Execution – Destroy
   • For HDD: remove from chassis; process through crusher/shredder.
   • For SSD/flash: process via fine shredder or pulverizer meeting your fragment size limit.
   • Record batch ID, input count/weight, start/end time, and operator.
   • Collect fragment samples periodically to verify size.
6. Verification
   • 100% report capture for software methods; store reports against Asset ID.
   • For destruction: perform hourly fragment checks; document results against acceptance criteria.
   • QC Auditor signs Verification Log daily.
7. Exception Handling
   • For any failure: complete Nonconformance Report (NCR) with cause, action, and outcome.
   • DSL approves rework or destruction.
8. Labeling & Segregation (Post-Sanitization)
   • Apply green SANITIZED labels to cleared/purged devices.
   • Move to Cage B (sanitized only). Update inventory status.
9. Certificates & Reporting
   • Generate Certificate of Sanitization/Destruction with customer name, PO/WO, asset list with serials, method, date, operator, and authorization signature.
   • Provide to customer; retain digital copy internally.
10. Records Retention

• Keep all logs, reports, certificates, and photos for [X years] in the Data Security Repository with controlled access.

Acceptance Criteria

• Software wipes: report states PASS and matches serial exactly.
• Crypto-erase: record of successful key destruction/reset.
• HDD destruction: fragments meet or are less than [your mm/in threshold].
• SSD/flash destruction: fragments meet [smaller threshold]; no intact memory packages.
• No unsanitized DBAs in sanitized/outbound areas.

Training & Competence

• New Sanitization Operators require two shadowed shifts and a competency check before solo work.
• Annual refresher covering tool updates and incident lessons learned.

Change Control

• DSL maintains Approved Tool List with version numbers. Any tool/profile change requires a controlled update and staff briefing.

---

Records you must be able to produce on demand (audit-ready)

• Intake Manifest & Seal Log
• Cage Access Logs (pre/post-sanitization)
• Sanitization Work Orders with method and operator
• Verification Reports (one per device for software methods)
• Destruction Batch Records with fragment checks
• Certificates of Sanitization/Destruction tied to asset serials
• Exception/NCR forms with CAPA evidence
• Training records and Approved Tool List (with versions)
• Inventory status reports showing transitions UNSANITIZED → SANITIZED/DESTROYED

Keep these organized by customer → work order → asset ID. Consistent filenames and index sheets save you during audits.

---

Verification strategies that pass scrutiny

• 100% device-level verification for software methods is the cleanest approach.
• Where statistical sampling is justified (e.g., homogeneous batches of identical media processed by a validated, unaltered workflow), document:
  • Sampling plan (e.g., AQL, lot size, sample size).
  • Rationale (history of zero defects, controlled inputs).
  • Escalation rule (any failure → 100% verification and process review).
• For destruction, define objective fragment size limits and measure on a routine cadence (e.g., each batch or every 30 minutes of operation).

---

Common nonconformities—and fast fixes

1. Missed DBAs at intake
   • Fix: Implement a DBA Identification Checklist by device type; retrain intake staff; spot-audit pallets.
2. Serial mismatches between report and label
   • Fix: Require barcode scanning at connect AND at report save; block save if mismatch.
3. Tool version drift (reports don’t match SOP)
   • Fix: Create an Approved Tool List with exact versions; IT locks updates; DSL signs off changes.
4. Mixed sanitization states in one cage
   • Fix: Physical barriers, color-coded bins, daily walkthrough checklist by QC Auditor.
5. Sampling used with no written rationale
   • Fix: Add a one-page Sampling Plan to the SOP; include when it’s allowed, lot definition, and escalation triggers.
6. Certificates lack traceability
   • Fix: Certificates must list asset IDs/serials, method, date, operator; never issue a certificate without that linkage.

---

KPIs for continuous improvement

• Sanitization first-pass yield (%)
• Time per device (software wipe) by media type/capacity
• Exception rate (failed wipes, aborted runs)
• Verification discrepancies (reports missing/mismatched)
• Cage integrity (finds of mis-segregation per month)
• On-time certificate issuance (%)

Review KPIs monthly; create CAPA for trends exceeding your thresholds.

---

Practical setup tips (low cost, high impact)

• Mount a visual workflow board at the cage: UNSANITIZED → METHOD → VERIFIED → SANITIZED/DESTROYED.
• Standardize label colors: red = DATA-BEARING (unsanitized), green = SANITIZED, black/white = inventory only.
• Use barcodes/QRs for asset IDs; scan into the wipe tool to avoid typos.
• Keep a hot-swap cart of adapters (SATA, NVMe, 2.5/3.5, USB docks) to reduce handling delays.
• For SSDs headed to destruction, seal containers immediately post-pull; don’t accumulate loose media on benches.

---

Final checklist (print for the station)

• DBA identified and labeled?
• Asset ID and serial captured?
• Method chosen and recorded (clear/purge/destroy)?
• Wipe/destruction executed using an approved profile/machine?
• Verification report or fragment check completed?
• Exception handled and documented (if any)?
• Status updated to SANITIZED/DESTROYED and assets moved to correct cage?
• Certificate generated and stored?
• Logs filed under the correct customer/WO?

---

Bottom line: If you can prove what happened to every single data-bearing asset—through clear procedures, objective verification, and tidy records—you’ll satisfy R2v3 expectations and build customer trust. Start by adopting the SOP above, tighten your intake controls, require 100% verification for software wipes, and make certificates and logs the natural by-product of doing the work right.

Purpose of this guide: give you a practical, copy-and-use framework to evaluate, approve, and monitor downstream vendors under R2v3—so you can defend decisions to auditors and reduce real-world risk.

---

1) What “downstream due diligence” actually means in practice

In R2v3, “downstream” covers every organization that receives your material, components, or data-bearing devices after they leave your control—refurbishers, brokers, repairers, recyclers, data sanitizers, smelters, and final disposers. Due diligence is the repeatable process you use to:

• Assess risks before using a vendor
• Decide whether to approve them (and for which materials)
• Define controls in writing (contracts, specifications, reporting)
• Monitor performance and re-assess on a schedule or when conditions change

Think of it as a living file per vendor: risk score → approval scope → controls → evidence of monitoring → periodic re-approval.

---

2) Map your material flows first (scope drives effort)

Before scoring anyone, write a one-page map of what goes where:

• Material types: data-bearing devices, batteries, displays, PCBs, plastics, precious-metal fractions, whole units for reuse, non-hazardous residuals.
• Path: Your facility → Vendor A → Vendor B (if any) → final process (reuse, recycle, energy recovery, landfill).
• Jurisdictions touched: your location, vendor’s location, any transit countries.
• Disposition intent: reuse/resale vs. material recovery vs. disposal.

This map determines the risk profile and the depth of checks required. High-risk examples: data-bearing devices; export to unfamiliar jurisdictions; hazardous fractions (e.g., batteries); multi-hop chains.

---

3) A pragmatic risk model you can implement tomorrow

Use a 100-point scoring model so decisions are explainable. Score each vendor on the factors below, then classify:
0–24 Low, 25–49 Moderate, 50–74 High, 75–100 Critical. Calibrate thresholds to your risk appetite.

Factor	Guiding questions	Score (0=best, 20=worst)
Regulatory exposure	Hazardous materials? Export? Permits clearly in place?	0–20
Data protection	Handles data-bearing assets? Proven sanitization controls?	0–20
Process maturity	Certified systems? Documented SOPs? Training & QC?	0–20
Traceability	Can they provide serial/material tracking and mass balances?	0–20
Reputation/history	Incidents, sanctions, insolvency, frequent ownership changes?	0–20

How to score quickly and fairly:

• Start every new vendor at 30 (moderate) pending evidence.
• Add points for identified weaknesses; subtract when strong, verified evidence exists.
• Always record the why in 1–2 lines per factor.

Decision rules (example):

• Low risk (≤24): desktop review, standard contract clauses, annual monitoring.
• Moderate (25–49): desktop review + document sampling (permits, training, wipes logs), semi-annual monitoring.
• High (50–74): remote interview, sample lot trial, quarterly KPIs, on-site audit within 12 months.
• Critical (≥75): do not approve; require corrective actions; reassess later.

---

4) Vendor onboarding: checklist you can reuse

Create a standard DDQ (due diligence questionnaire) and request a small, defined document set. Keep it lean; quality beats bulk.

Core DDQ topics:

• Company identity (legal name, registration, facility addresses, contacts)
• Scope of services (what they do with your material, exact processes)
• Licenses/permits and scope codes
• EHS controls and training applicable to your material
• Data sanitization method(s), verification and chain-of-custody
• Downstream partners they use and how they vet them
• Record types kept, retention times, confidentiality practices
• Insurance coverage and limits
• Incident reporting and CAPA process

Document pack to request:

• Facility permit(s) or licenses applicable to your material and location
• Process flow or SOP excerpts for the operations you use
• Recent training record sample (titles, dates, attendees)
• Data sanitization SOP and a redacted wipe verification log (if applicable)
• Example of shipment documentation (BOL, manifest, serial list)
• Current insurance certificate
• Template monthly KPI or summary report (if they provide one)

Tip: ask for exactly one sample of each record type; auditors want to see that you reviewed evidence, not collect gigabytes of PDFs.

---

5) Approval scope: the secret to passing audits smoothly

Approval is not all-or-nothing. Approve by material type and process. Your approval memo should include:

• Vendor name and facility address
• Approved materials/processes (e.g., “SSD wipe & resale,” “Li-ion battery consolidation and export to smelter X”)
• Prohibited materials/processes (e.g., “No CRT glass”)
• Risk score and date of assessment
• Required controls (reporting, labeling, packaging, data logs, EHS conditions)
• KPIs and monitoring frequency
• Review/expiry date

This memo becomes the master control your shipping and sales teams use when choosing outlets.

---

6) Contractual controls that actually reduce risk

Bake your requirements into the agreement or purchase order terms. Keep clauses short and enforceable:

• Compliance warranty: vendor affirms compliance with applicable laws and required standards for the approved scope.
• Use-of-downstream restriction: vendor may not change downstream processors for your material without prior written notice and updated due diligence.
• Data protection: specific sanitization methods, verification, and reporting obligations; immediate notice of any data incident.
• Traceability & reporting: serial lists or mass-balance summaries per lot; monthly KPI (on-time reports, nonconformities, yields).
• Right to audit: reasonable access for remote or on-site reviews; cooperation in investigations.
• Incident & CAPA: timelines for notification, containment, corrective action, and closure evidence.
• Termination trigger: conditions that immediately suspend shipments (permit lapse, KPI failure trend, incident severity).

---

7) Ongoing monitoring: cadence, KPIs, and evidence to keep

Cadence by risk:

• Low: annual check-in + license renewal check
• Moderate: semi-annual KPI review + annual document refresh
• High: quarterly KPI review + annual on-site or remote audit
• Triggered review: any incident, regulatory change, ownership change, change in downstream path, or material type

KPIs that matter:

• Reporting timeliness: % shipments with complete documentation within X days
• Data sanitization validation: % lots with verification logs, % failures detected and resolved
• Material accountability: variance between shipped mass and processed/received mass within agreed tolerance
• Nonconformities: count and severity; closure time for CAPA
• Safety/environment: reported incidents related to your lots; trend over time

Evidence to keep in the vendor file:

• KPI summaries and your review notes
• Updated permits/licenses (or screenshots of public registry entries)
• Training matrix snapshot (roles related to your material)
• Any incident reports and CAPA closure evidence
• Re-approval memo with updated risk score and next review date

---

8) How to run a remote or on-site audit without wasting a day

Pre-audit (1–2 weeks before):

• Send scope: which processes and materials you will review
• Request a single recent lot involving your material for document tracing
• Share a 10–12 point agenda and timebox to 3–4 hours

During the audit:

• Walk the material flow in order: receiving → storage → processing → staging → outbound
• Trace one lot: BOL → receiving log → processing log → output documentation → downstream shipment proof
• Interview process owner(s) for data wiping, hazardous handling, and packing
• Sample PPE, labeling, segregation, and spill kits in the areas used for your material

Common findings to watch for:

• Mismatch between SOP and actual practice
• Incomplete wipe verification fields (e.g., missing operator ID or date/time)
• Containers missing labels or date
• Mass/serial reconciliation gaps
• Expired permits on the wall vs. current in the file

Close-out:

• Classify findings (minor/major)
• Agree on CAPA owners and due dates
• Record updated risk score if warranted

---

9) Handling multi-hop downstreams (beyond your first vendor)

If your vendor sends material to a further processor, you still need adequate assurance that the final path is legitimate. Practical approach:

• Require your vendor to disclose the named downstream for your material and keep an internal list.
• For low-risk streams, review the downstream’s public credentials and a sample invoice/BOL showing the path.
• For higher-risk streams (data-bearing, hazardous, export), perform at least a desktop review of the downstream, or obtain your vendor’s documented vetting results and sample permits.
• If the downstream changes, treat as a triggered review and pause shipments until reassessed.

---

10) Red flags and what to do immediately

Immediate holds on new shipments if you see any of the following:

• Claim of capacity far above the facility’s apparent scale
• Refusal to provide even basic evidence (permits, sample logs)
• Frequent name changes, shell companies, or mismatched addresses
• Export offers that seem too cheap relative to market recovery value
• Repeated delays in providing data wipe logs or mass balances

Action: escalate, notify management, log a potential nonconformity, and require corrective actions before resuming shipments.

---

11) Recordkeeping: how long and how to organize

Keep at least:

• Risk score sheets and approval memos for each vendor
• DDQ responses + sample evidence reviewed
• Contract or PO terms containing your controls
• Monitoring artifacts (KPI reviews, email approvals, meeting notes)
• Audit checklists, findings, and CAPA closures
• Shipment-level traceability records (serials or mass balances)

Organization tip: one folder per vendor with subfolders: 01_Approval, 02_Contract, 03_Monitoring, 04_Audits, 05_Traceability. Keep a master index spreadsheet with vendor name, scope, risk tier, next review date, downstreams, and notes.

---

12) Typical nonconformities—and how to prevent them

• Approval too generic: Fix by issuing material-specific approval scopes and updating shipping instructions.
• Evidence not reviewed: Fix by adding a short checklist to every review (what you checked, date, initials).
• No trigger reviews: Fix with a one-page SOP listing triggers and responsible person; add a simple email template: “Triggered review opened because X.”
• Great policy, weak practice: Fix by training process owners on the exact documents auditors will ask for and doing quarterly internal spot checks.

---

13) Step-by-step SOP you can adopt

1. Initiate: business owner requests a new vendor; due-diligence lead opens a file and assigns provisional risk 30.
2. Collect: send DDQ and document pack list; receive samples.
3. Assess: score the five risk factors; write 1–2 lines rationale per factor.
4. Decide: draft approval memo with scope, controls, KPIs, cadence.
5. Contract: include control clauses; communicate packaging/labeling and reporting requirements.
6. Onboard: run a trial shipment (if applicable); validate documentation flow.
7. Monitor: review KPIs per cadence; log outcomes; adjust controls if needed.
8. Audit: schedule remote/on-site per risk or when triggered.
9. Re-approve: update risk score annually or after major changes; re-issue approval memo.
10. Retire: if terminated, record final status, reason, and where remaining material will go.

---

14) Quick templates (copy into your documents)

Risk score notes (per factor, 1–2 lines):

• Regulatory exposure: Handles Li-ion only; domestic processing; permits verified 2025-09—score 12.
• Data protection: No data handling for our scope—score 0.
• Process maturity: ISO-like system, training records sampled—score 8.
• Traceability: Mass balance reports monthly, variances <2%—score 6.
• Reputation/history: Stable ownership since 2017; no adverse media—score 4.
  Total: 30 → Moderate. Decision: approve for Li-ion consolidation; quarterly KPI review.

Triggered review email:
Subject: Triggered Review — [Vendor], [Reason]
Body: A change was reported: [permit expired/ownership change/downstream change/incident]. Shipments paused for this stream. We will reassess documents and confirm approval scope within [X] business days.

---

15) Final checklist (use before you ship)

• Material flow map updated; jurisdictions understood
• DDQ and sample evidence reviewed; risk score documented
• Approval memo with specific scope and expiry date issued
• Contract terms include downstream change notice, reporting, audit rights, data/EHS clauses
• KPI set and monitoring cadence scheduled on calendar
• Shipping/warehouse teams briefed on scope and packaging/labeling requirements
• Vendor file complete and indexed

---

Bottom line

Downstream due diligence under R2v3 is not about collecting the biggest binder—it’s about clear scope, justified risk decisions, and fresh evidence that shows your controls work in the real world. If you maintain a living vendor file with a logical risk score, material-specific approval, and consistent monitoring, you’ll satisfy auditors and, more importantly, keep your supply chain trustworthy.

Goal of this guide: give you a practical, copy-ready blueprint for the documents, logs, and evidence that an R2v3 auditor will expect to see—and how to organize them so they’re complete, consistent, and easy to verify.

---

1) What “audit-ready” means in practice

Audit-ready documentation is not a pile of forms. It’s a controlled system where:

• Every policy and SOP has a current version, an owner, and a last-review date.
• Every process produces objective records (logs, photos, serials, manifests) that prove you followed the SOP.
• You can trace any unit or batch from intake to final disposition and show who did what, when, and based on which instruction.
• Gaps trigger corrective actions (CAPA) that are documented and closed out.

Think in layers:

1. Top level: Policies (intent, scope, responsibilities).
2. Middle: SOPs/work instructions (who/when/how).
3. Bottom: Records/evidence (what actually happened).

---

2) Document control that won’t break under audit

Minimum elements for each controlled document:

• Title, unique ID, version, effective date
• Owner/approver signatures (or documented e-approval)
• Revision history (what changed, why, by whom)
• Distribution list (who must use it)
• Next review due date

Practical tips

• Keep a Document Index spreadsheet: columns for ID, title, process, version, effectivity, owner, reviewer, next review date, status (draft/active/obsolete).
• Stamp or watermark OBSOLETE on retired versions; keep them read-only in an “Archive/Obsolete” folder.
• Use the same naming convention everywhere: PROC-ITAD-INTAKE-001_v3.1_2025-02-10.

---

3) Core logs your facility should maintain (and the fields that matter)

Below are copy-ready field sets you can implement in spreadsheets or your system of record. If you already track these data points digitally, export sample reports and keep them with your audit pack.

A) Receiving & Chain-of-Custody Log

• Intake Date/Time
• Customer/Source
• Shipment/PO/Work Order
• Transporter/Driver ID
• Seal Number(s) and Condition
• Pallet/Container Count
• Unit Count by Category (e.g., laptops, drives, batteries)
• Unique Intake Batch ID
• Initial Condition/Exceptions (photos if applicable)
• Receiver Name/Signature

Evidence add-ons: dock photos, scale tickets, exception tags, discrepancy reports.

B) Inventory Tracking & Work-in-Process (WIP)

• Batch ID / Serial Number
• Asset Tag(s)
• Location (rack/room/area) with time stamps for moves
• Process Stage (intake → triage → data wipe → test → grade → disposition)
• Responsible Technician
• Status (pass/fail/hold/scrap)
• Exception Code (with CAPA link if recurring)

Evidence add-ons: barcode scans, system audit trails, shelf labels, quarantine tags.

C) Data Sanitization / Destruction Log

• Device Serial & Media Serial (if separate)
• Media Type (HDD, SSD, mobile, tape)
• Method (clear/purge/destroy) and Tool/Equipment Version
• Sanitization Settings/Profile
• Verification Result (pass/fail, sample size)
• Technician Initials/ID
• Date/Time
• Rework Required? (Y/N) and reason
• Final Disposition (reused/resold/destroyed)
• Supervisor Review/Sign-off

Evidence add-ons: wiping tool reports, screenshots, destruction photos, batch certificates.

D) Testing & Grading Log (for reuse/refurbish)

• Serial/Asset
• Functional Tests Performed (list/checkbox)
• Cosmetic Grade (with criteria reference)
• Parts Replaced (with tracking of used parts)
• Final Grade and SKU mapping
• Technician ID and Date
• QA Sample Check (Y/N) and result

Evidence add-ons: test bench screenshots, grading photo samples, QA sign-offs.

E) Downstream Due Diligence (DDQ) Register

• Vendor Name & Role (e.g., smelter, refurbisher, recycler)
• Materials/Devices Sent
• Risk Rating (method documented)
• Certifications/Permits (IDs, issue/expiry dates)
• Insurance (type, limits, expiry)
• Audit/Assessment Date and Outcome
• Corrective Actions and Status
• Monitoring Frequency (e.g., annual, semi-annual)
• Next Review Due

Evidence add-ons: copies of permits/certs, audit reports, corrective action closures.

F) Environmental, Health & Safety (EHS) & Incident Log

• Incident/Observation Type (spill, injury, near miss, battery event)
• Date/Time and Location
• People Involved
• Immediate Action Taken
• Root Cause (after investigation)
• Corrective/Preventive Actions, Owner, Due Date
• Closure Date and Verification

Evidence add-ons: photos, SDS references, training refresh records.

G) Training & Competency Matrix

• Employee Name/ID
• Role/Process Authorization (what they’re allowed to do)
• Required Training (by role/process)
• Completion Dates & Trainers
• Expiry/Refresh Dates
• On-the-job competency check (observed by… date…)

Evidence add-ons: quizzes, observation checklists, retraining logs.

---

4) Evidence mapping: prove each step happened as written

Create a one-page “Evidence Map” that links each SOP to its evidence sources. Auditors love this because it shortens the path from “policy says X” to “show me X happened yesterday.”

Example (excerpt):

SOP / Control	Primary Record	Secondary Evidence	Owner
Intake & Chain-of-Custody	Receiving Log + photos	Seal logs, exception forms	Warehouse Lead
Data Wipe	Wipe Log + tool report	Sample verification sheet	ITAD Supervisor
Batteries Handling	Hazardous storage log	Spill kit inspection checklist	EHS Coordinator
Downstream Shipment	Bill of Lading, manifest	Scale ticket, export paperwork	Logistics Lead
CAPA Management	CAPA register	Root cause analysis worksheet	Compliance Manager

Keep the map printed in your Audit Binder and mirrored in your quality folder.

---

5) How to design records that survive scrutiny

Make it tamper-evident:

• Use unique IDs and date/time stamps.
• Limit edit rights; capture who changed what and when.
• For paper forms, pre-number pages, and require initials on corrections.

Make it consistent:

• Standardize dropdowns/lists (e.g., exception codes).
• Define controlled acronyms; include a glossary in the front of your binder.
• Align units of measure and time zones across systems.

Make it verifiable:

• Attach photos/screenshots where they add proof.
• Cross-check counts: intake vs. WIP vs. outbound.
• Keep sampling plans and QA checks documented and trended.

---

6) Building your CAPA system (the easiest way that actually works)

CAPA flow:

1. Detection: nonconformity, incident, repeated defect, failed audit point.
2. Containment: quarantine product, stop the line if needed.
3. Root Cause: use a simple method (5 Whys, fishbone). Document it.
4. Action Plan: corrective steps, owners, due dates; preventive steps to stop recurrence.
5. Verification of Effectiveness: check results after a defined period; trend KPIs.
6. Close: sign-off by process owner and compliance.

CAPA record fields (copy-ready):

• CAPA ID, Date Raised, Raised By
• Issue Description and Impact
• Immediate Containment
• Root Cause Summary
• Corrective Actions (each with owner/due date)
• Preventive Actions (owner/due date)
• Verification Method & Date
• Status (open/overdue/closed)

Make CAPA status a standing agenda item in management meetings; auditors will ask.

---

7) Downstream due diligence: records that count

Auditors expect proof that your vendors are appropriate for the materials/devices they receive and that you monitor them.

Your DDQ pack should include:

• Completed questionnaires with supporting evidence (permits, certifications, insurance).
• A risk rating method (e.g., 1–5 scale with criteria like geography, process risk, history).
• Approval decisions tied to risk (e.g., high-risk requires a site visit or third-party audit).
• Ongoing monitoring cadence (calendarized), plus notes from reviews.
• Shipment matching: outbound records that show where each stream actually went.

Keep a Vendor Folder per downstream: DDQ, approvals, expiries, monitoring log, corrective actions.

---

8) Data security & sanitization: evidence beyond the wipe report

Data security is more than a wiping certificate. Build a complete trace:

• Chain-of-custody from intake: who had access, where it was stored, when it moved.
• Technician authorization: only trained/authorized people can sanitize or destroy media.
• Tool control: approved software/hardware versions, configuration control, calibration if applicable.
• Verification: sample checks or 100% verification as your method requires; keep a verification log.
• Exception handling: any failures, reworks, or physical destruction events tied to the serial number.
• Final status recorded in inventory: reused/resold/destroyed, with date and reference to supporting evidence.

---

9) EHS documentation that’s often missing (and gets findings)

• Battery and energy storage logs: intake segregation, storage conditions, inspection frequency.
• CRT, mercury, toner, and other hazardous fractions: handling SOPs, training proof, spill response drills.
• Inspection checklists for eyewash stations, spill kits, fire extinguishers; with correction notes and close dates.
• Air/noise monitoring if your processes require it; keep the last report and action plan.
• PPE issuance and fit-testing records where relevant.

Tie EHS training to roles. If someone handles batteries, their training record should say so explicitly.

---

10) Internal audits & management review that add real value

Internal audits

• Build a schedule that covers all processes at least annually, with higher-risk areas more frequently.
• Use process-based checklists tied to your actual SOPs, not generic lists.
• Record evidence observed, not just pass/fail.
• Open CAPAs for significant findings and trend recurring minors.

Management review

• Use a one-page dashboard: incoming volumes, reuse rate, data wipe pass rate, incident counts, CAPA aging, vendor risk changes.
• Record decisions and actions (resources, changes to objectives, training needs).
• Keep meeting minutes with attendees and dates.

---

11) Retention & retrieval: how long to keep what

Create a Retention Matrix that sets periods by record type and legal/contractual needs. Typical practice:

• Policies/SOPs: active + a few years after obsolescence
• Intake, inventory, chain-of-custody: multi-year minimum
• Data sanitization/destruction: multi-year minimum (often aligned to customer contracts)
• Downstream approvals, permits, monitoring: through relationship + several years
• EHS incidents and training: per regulatory and insurer guidance

Whatever period you choose, write it down and apply it consistently. Ensure rapid retrieval: if an auditor asks for “wipe logs for batch INT-2025-0912,” you should fetch them in minutes.

---

12) Common pitfalls (and how to avoid them)

• Beautiful SOPs, empty logs. Fix: align every SOP with a mandatory record and a check.
• Different numbers in different systems. Fix: daily reconciliation between intake, WIP, and outbound; investigate variances.
• Expired downstream certs. Fix: a vendor calendar with 30-day reminders; no shipments if expired.
• Training says “general safety.” Fix: specify process authorization by role (e.g., “authorized for HDD destroy”).
• CAPAs that never close. Fix: weekly CAPA stand-up; escalate overdue items.

---

13) Your 30-day implementation plan

Week 1

• Build your Document Index and assign owners.
• Approve a Document Control SOP.
• Draft the Evidence Map.

Week 2

• Stand up 5 core logs: Receiving/CoC, Inventory/WIP, Data Wipe, Downstream DDQ, EHS Incidents.
• Train owners and start using the forms immediately.

Week 3

• Populate the Vendor Folders and risk ratings; set monitoring dates.
• Run a mini internal audit on one process; open CAPAs.

Week 4

• Reconcile one full batch trace end-to-end and fix gaps.
• Hold a Management Review to set KPIs and resourcing.
• Lock versions, archive drafts, and set next review dates.

---

14) Final sanity check before the auditor arrives

• Can you trace one unit from intake to final disposition with matching counts, signatures, and dates?
• Can you show who performed and verified each critical step and that they were authorized and trained?
• Can you prove your downstream was approved and monitored at the time of shipment?
• Do your CAPAs show root cause and effectiveness checks?
• Are your policies/SOPs current, controlled, and consistent with how work is actually done?

If the answer is yes to all five, your documentation system is not just compliant—it’s operationally useful. That’s what makes evidence stand up in an R2v3 audit.

Use this as a practical, printable playbook. It translates R2v3 into day‑to‑day actions, owners, and evidence to show an auditor. Always defer to the official R2 Standard, the R2 Equipment Categorization (REC), the Code of Practices (COP), and SERI guidance when in doubt.

---

Quick‑Start & Table of Contents

How to use this guide

1. Confirm your Scope and which Appendices apply. 2) Assign Owners. 3) Print the checklists for only the clauses that apply. 4) Build your Evidence Binder using the clause‑to‑evidence map. 5) Run the Self‑Assessment Scorecard and close gaps. 6) Rehearse with the Auditor Interview Playbook. 7) Keep it current monthly.

Table of contents

1. Quick Orientation
2. Roles & RACI (with matrix template)
3. Evidence Binder (with clause‑to‑evidence map)
4. Core Requirements CR‑1…CR‑10 (plain‑English + checklists)
5. Appendix Applicability Matrix + Decision Tree
6. Process Requirements A–G (plain‑English + checklists)
7. Practical Tools (90‑day plan, floor tour, records map, common NCs)
8. Self‑Assessment & Readiness Scorecard
9. Printables: Daily/Weekly/Monthly/Quarterly/Annual checks
10. Templates & Posters

---

Quick Orientation: How R2v3 is Organized

• Core Requirements (CR 1–10) — apply to every certified facility.
• Process Requirements (Appendices A–G) — apply only if you perform those operations (e.g., Data Sanitization, Test & Repair, Brokering, PV Modules).

Manager’s first job: publish a clear Scope (CR‑1), determine which Appendices apply, then build procedures, training, records, and metrics around both.

---

Roles & RACI (suggested)

• Top Management (TM): policy, resources, objectives, management review.
• EHS Manager (EHS): risk assessment, legal register, training, emergency response, inspections.
• Operations Lead (OPS): sorting, categorization, processing controls, throughput, facility controls.
• Data Security Lead (DSL): data policy, Appendix B controls, incident response, access/security.
• Quality/Testing Lead (QTL): REC categories, diagnostics, Appendix C, outgoing conformity.
• Downstream Chain Lead (DSV): Appendix A due diligence, contracts, monitoring.
• Logistics Lead (LOG): transport compliance, chain of custody, packaging, carrier vetting.
• PV Modules Lead (PVL): if applicable, Appendix G hazards, testing, routing, downstreams.

Tip: Assign each clause/appendix an Owner, Backup, and a Monthly “evidence refresh” reminder.

RACI Matrix (fill‑in template)

Clause/Process	TM	EHS	OPS	DSL	QTL	DSV	LOG	PVL
CR‑1 Scope	R	C	C
CR‑2 Hierarchy	A	C	R			C
CR‑3 EHSMS	C	R	C
CR‑4 Legal	A	R	C			C	C
CR‑5 Throughput	C		R		R	C
CR‑6 Sorting/REC		C	R		R
CR‑7 Data Security				R
CR‑8 Focus Materials		R	R			C
CR‑9 Facility		R	R
CR‑10 Transport			C				R
A Downstreams						R	C
B Data Sanitization				R
C Test & Repair					R
D Specialty Reuse		C			R
E Materials Recovery		R	R			C
F Brokering						R	C
G PV Modules		R	C			C		R

Legend: R Responsible, A Accountable, C Consulted, I Informed.

---

Evidence Binder (what auditors love to see)

Keep a digital index with links to: policies, procedures/SOPs, training, competency records, forms/checklists, logs, sample contracts/BLs/manifests, calibration and maintenance, internal audit & CAPA, management review, legal register, permits/consents, emergency drills, vendor qualifications, material balance, REC mappings, incident logs, corrective actions.

Clause‑to‑Evidence Map (print this)

Clause	Must‑have Evidence (examples)
CR‑1 Scope	Public scope statement; certificate/annex; process map; list of controlled external locations; change log
CR‑2 Hierarchy	Hierarchy policy; routing SOP; blocked/recalled list; sampled routing decisions with evidence
CR‑3 EHSMS	ISO/RIOS certificate; risk register; training matrix; emergency drill logs; internal audit & CAPA; management review minutes
CR‑4 Legal	Legal register; permits/licences; import/export dossiers; compliance audits
CR‑5 Throughput	Inbound/outbound logs; REC categories; mass‑balance; WIP aging report
CR‑6 Sorting/REC	Evaluation forms; REC mapping posters; nonconforming material log; calibration records
CR‑7 Data Security	Data policy; access control list; incident plan & drills; chain‑of‑custody logs
CR‑8 Focus Materials	FM identification list; storage/inspection logs; downstream approvals; export screens
CR‑9 Facility	Housekeeping/inspection checklists; PM records; fire/battery controls; closure plan & financial coverage
CR‑10 Transport	Approved carriers; packaging/segregation SOPs; shipping docs; seal logs
A Downstreams	Downstream matrix; qualification pack; contracts; monitoring reports; exception/CAPA
B Data Sanitization	Method matrix; tool validation; wipe/destruction logs; per‑device reports; access logs
C Test & Repair	SOPs; grading guide; ESD program; outgoing QC; RMA/warranty analysis
D Specialty Reuse	Competency proofs; regulatory checks; calibration; outgoing documentation
E Materials Recovery	Depollution WI; shredder controls; monitoring data; downstream verifications
F Brokering	Broker SOP; contracts; chain‑of‑custody; downstream monitoring
G PV Modules	PV risk assessment; test plan; breakage controls; downstream files; inventory/traceability

File‑Tree Starter (mirror this in your DMS)

/01_Policies
/02_SOPs & Work_Inst
/03_Training & Competency
/04_Legal & Permits
/05_Throughput & Mass_Balance
/06_Downstreams (Appendix_A)
/07_Data_Security (Appendix_B)
/08_Test_Repair (Appendix_C_D)
/09_Materials_Recovery (Appendix_E)
/10_Brokering (Appendix_F)
/11_PV_Modules (Appendix_G)
/12_Internal_Audit_CAPA
/13_Management_Review
/14_Facility_Inspections_PM
/15_Transport & CoC

Auditor Sampling Recipe (use every quarter)

• Pull 3 random lots from last 90 days and follow the paper trail end‑to‑end.
• For each applicable Appendix, pull 1 process run (e.g., a wipe batch, a repair traveler, a brokered shipment).
• Log gaps → open CAPA with owner and due date.

---

Core Requirements (CR 1–10)

CR‑1 Scope

Plain‑English: Say exactly what you do, where, and what R2 parts apply.

You need:

• A public Scope statement that matches reality (processes, materials, devices, brokered activities, any external controlled locations).
• Your certificate lists applicable Appendices and legal entities.
• Public list of other locations you control that handle used electronics but are not R2 certified.

Checklist (Owner: TM)

• Scope statement published (site, website, or certificate annex).
• Processes & external locations inventory up to date.
• Applicable Appendices identified (see matrix below) and shown on the certificate.
• Legal names/entities on certificate verified.
• Non‑certified related locations list published and current.

Show the auditor: current certificate, scope narrative, process map, site map, list of external locations, change log.

---

CR‑2 Hierarchy of Responsible Management Strategies

Plain‑English: Reuse first when lawful and safe. If not reusable, go to responsible materials recovery. Avoid disposal unless unavoidable and legal.

You need:

• A policy and SOPs that prioritize reuse, then materials recovery.
• Controls preventing reuse of illegal, counterfeit, recalled, or stolen items.
• Evidence that routing decisions follow the hierarchy.

Checklist (Owner: TM + OPS)

• Hierarchy policy approved and communicated.
• Intake triage SOP directs reuse-capable items to reuse processes; others to materials recovery.
• Blocklist SOP (lost/stolen, counterfeit, recalls) enforced.
• Periodic sample of routing decisions with evidence (e.g., evaluation forms, photos, test results).

Show the auditor: policy, routing SOPs, sampled job tickets, nonconforming material log.

---

CR‑3 EH&S Management System (EHSMS)

Plain‑English: Run a real EHS management system (ISO 14001 + ISO 45001 or RIOS). Know your hazards and control them.

You need:

• Certification to an approved EHSMS (or documented conformance if allowed by COP) and effective risk assessments for your processes (e.g., batteries, CRTs, PV, shredding, manual disassembly).
• Training matrix & competency, PPE, incident/near‑miss, emergency preparedness, maintenance & housekeeping.
• Internal audits at least annually and management reviews.

Checklist (Owner: EHS)

• Current ISO 14001/45001 or RIOS certificate (or approved pathway per COP).
• Process hazard analyses (incl. chemical, electrical, ergonomic, fire, explosive risks).
• Emergency plans (fire, spill, medical, utility loss) + drills recorded.
• Safety inspections and preventive maintenance on schedule.
• Training: orientation + task‑specific; competency verified.
• Annual EHSMS internal audit + CAPA; management review minutes.

Show the auditor: certificates, risk register, SOPs, drills, inspection logs, training/competency records, internal audit + CAPA, management review.

---

CR‑4 Legal & Other Requirements

Plain‑English: Know the laws that apply (environmental, health & safety, waste, import/export, data, privacy) and prove you follow them.

You need:

• A legal register covering all jurisdictions (site + shipping). Include permits/consents, waste codes, transporter and destination authorizations, and data/security rules.
• A compliance plan with monitoring, documented checks, and corrective actions. Include proof of lawful imports/exports when applicable.
• Consider customer and other contractual requirements.

Checklist (Owner: EHS + LOG + DSV)

• Legal register current (incl. cross‑border flows, Basel/equivalents, customs/classifications).
• Permits/licenses displayed and valid; conditions tracked.
• Import/export dossier template (evidence of legality) defined; shipping files include it.
• Periodic legal compliance audits completed, actions closed.

Show the auditor: legal register, sample shipping files, permits, audit reports, CAPA log.

---

CR‑5 Tracking Throughput

Plain‑English: Know what comes in, what happens, and what leaves — by quantity, category, and destination.

You need:

• Inbound/outbound logs with weights/counts, categories (per REC), dates, job IDs, and downstreams.
• Mass balance (e.g., monthly/quarterly) showing reasonableness vs. processes & yields.
• Work‑in‑process (WIP) controls and aging.

Checklist (Owner: OPS + QTL)

• System captures inbound/outbound by REC category, weight/count, date, and DSV.
• Reconciliation report (mass balance) prepared and reviewed at least quarterly.
• WIP aging report with triggers for action.

Show the auditor: sample lots from receipt → process → shipment, mass balance workbook, dashboards.

---

CR‑6 Sorting, Categorization & Processing

Plain‑English: Evaluate items, assign REC categories, and route them correctly. Do the work you say you do, in control.

You need:

• Evaluation SOPs by product family (PCs, servers, phones, displays, PV, etc.).
• REC mapping (internal grades ↔ REC). Clear acceptance/rejection criteria for reuse.
• Controls to prevent mixing of incompatible or hazardous streams; defect/hold process.

Checklist (Owner: OPS + QTL)

• Evaluation forms/templates live and used.
• REC mapping published at workstations.
• Nonconforming/hold procedure + quarantine area.
• Calibration/maintenance for test equipment.

Show the auditor: traveler packets, evaluation records, REC labels, calibration logs.

---

CR‑7 Data Security

Plain‑English: Prevent data breaches. Sanitize or physically destroy data storage devices under controlled conditions — and prove it.

You need:

• Data security policy (roles, access control, authorization levels, disciplinary consequences).
• Physical/logical security of data areas (restricted access, CCTV or equivalent controls, chain of custody, tamper‑evident packaging, device tracking).
• Sanitization SOPs aligned to device type and data sensitivity; incident response.

Checklist (Owner: DSL)

• Access control list + authorization records for data handlers.
• Secure areas defined; security controls tested.
• Incident response plan + drills.
• If you sanitize: Appendix B is applicable (see below).

Show the auditor: policy, access logs, chain‑of‑custody, incident drills, sample sanitization packets.

---

CR‑8 Focus Materials (FM)

Plain‑English: Identify Focus Materials (e.g., mercury devices, CRT glass, some batteries and lamps, certain PV components). Manage them to prevent uncontrolled releases and ensure legal downstream recovery.

You need:

• FM identification by device/component, safe handling & storage, containment, spill kits, emergency response.
• Qualified downstream vendors with appropriate permits/capabilities; additional controls for export.
• Evidence that non‑FM streams are still managed per the hierarchy and law.

Checklist (Owner: EHS + DSV + OPS)

• FM inventory & handling SOPs.
• FM storage specs (closed, labeled, compatible, inspected).
• FM downstream qualifications complete and current; contracts reference FM controls.
• Export screens and records (where applicable).

Show the auditor: FM list by SKU/bill of materials, inspections, training, downstream approvals, shipment files.

---

CR‑9 Facility Requirements

Plain‑English: Your building, equipment, and housekeeping protect workers, the public, the environment, and product integrity.

You need:

• Good housekeeping; weather/containment controls; ventilation and dust/noise controls where needed; fire prevention & protection; battery and lithium handling precautions; security.
• Maintenance program; equipment safeguarding; pedestrian/forklift separation; signage.
• Closure plan & financial coverage sized to your risks and inventory profile.

Checklist (Owner: EHS + OPS)

• Facility controls checklist (weekly/monthly) with photos.
• Preventive maintenance plan executed; critical spares identified.
• Storage density limits posted and respected; aisles clear.
• Battery/PV/CRT special controls implemented where applicable.
• Closure plan reviewed annually; financial instrument current.

Show the auditor: inspection logs, maintenance records, floor plans, closure plan & financial coverage, photos.

---

CR‑10 Transport

Plain‑English: Ship legally and safely, with accurate descriptions and protection of data and environment.

You need:

• Carrier vetting, packaging/segregation SOPs, accurate codes/descriptions, placarding where required.
• Chain of custody and security for data‑bearing devices; seals/tamper evidence where appropriate.
• Export/import evidence of legality.

Checklist (Owner: LOG)

• Approved carriers list; licenses/insurance validated.
• Pack/segregation SOPs by device/material (incl. batteries, displays, PV).
• Shipping descriptions/codes verified before dispatch.
• Seal logs and exception handling.

Show the auditor: sample BLs/manifests, carrier files, packaging SOPs, seal records, training.

---

Appendix Applicability Matrix (quick self‑screen)

• A – Downstream Recycling Chain: If you transfer control to any downstream (reuse, repair, recovery, disposal) — almost everyone.
• B – Data Sanitization: If you wipe or destroy data storage devices, or manage data‑bearing devices for reuse.
• C – Test & Repair: If you functionally test and/or repair devices/components for reuse.
• D – Specialty Electronics Reuse: If you refurbish, test, or resell specialized equipment (e.g., medical, lab, industrial) requiring special competencies/compliance.
• E – Materials Recovery: If you mechanically or chemically process to recover materials (e.g., shred, smelt partners, de‑manufacture to commodity streams).
• F – Brokering: If you control equipment to a downstream without physically receiving/processing it at your site.
• G – PV Modules: If you handle, process, store, transport, or broker photovoltaic (solar) modules/cells.

If an activity is outsourced, Appendix A controls still apply to managing that downstream.

---

Appendix Applicability Decision Tree (quick)

Start → Do you transfer control to any downstream? → Yes → Appendix A applies
         ↓ No → (rare; recheck)
Do you handle data‑bearing devices or sanitize/destroy storage? → Yes → Appendix B
Do you test/repair for reuse? → Yes → Appendix C (and D if specialized equipment)
Do you mechanically/chemically recover materials? → Yes → Appendix E
Do you arrange downstreams without physical possession? → Yes → Appendix F
Do you handle/broker PV modules? → Yes → Appendix G

If an activity is outsourced, Appendix A controls still apply to managing that downstream.

Process Requirements (Appendices A–G)

Appendix A — Downstream Recycling Chain (DSV)

Plain‑English: Know your downstreams, qualify them, contract them, and keep verifying.

You need:

• A downstream map from your dock to final disposition for each stream.
• Qualification criteria (permits, capabilities, certifications, FM handling, legality), initial due diligence, and ongoing monitoring.
• Contract terms requiring conformance and allowing oversight.
• Records that shipments matched the plan (no leakage to uncontrolled destinations).

Checklist (Owner: DSV)

• Stream‑by‑stream downstream map maintained.
• Qualification pack per downstream (permit/licensing, capabilities, references, audit/assessment).
• Contract language covering R2 duties, FM, confidentiality, sub‑tier control.
• Annual monitoring (desktop or on‑site); re‑qual triggers defined.
• Shipment exception process (mismatches, rejections) with CAPA.

Show the auditor: current downstream matrix, sample qualifications, contracts, monitoring reports, exception/CAPA log.

---

Appendix B — Data Sanitization

Plain‑English: Sanitize (logical erase) and/or physically destroy per device type, verify the result, and trace each device.

You need:

• Device‑specific methods (aligned to NIST 800‑88 or stricter where required). When using physical destruction, follow method tables and controls.
• Per‑device tracking (unique ID/serial) from receipt → sanitization → verification → status.
• Secure area controls, tool validation, operator competency, periodic method effectiveness checks.
• Incident handling for failed sanitization or chain‑of‑custody breaches.

Checklist (Owner: DSL)

• Sanitization matrix (media type × method × verification) published.
• Wipe tools validated; logs capture start/stop, result, operator, hash where applicable.
• 100% verification for logical sanitization; defined sampling/inspection for physical destruction residues per method.
• Per‑device certificate/report available for customers on request.
• Access controls, cameras (or equivalent), and storage security working.

Show the auditor: wipe logs, destruction logs/photos, calibration/validation of tools, per‑device reports, access logs, incident records.

---

Appendix C — Test & Repair

Plain‑English: Prove you’re competent to test/repair, grade honestly, and disclose what the buyer is getting.

You need:

• Diagnostic procedures by product family; competence/training for techs; calibrated test equipment.
• Functional and cosmetic grading tied to REC (and your sales channels).
• Repair parts traceability and quality controls; ESD controls where needed.
• Outgoing documentation: test results, firmware/lock status, data sanitization status.

Checklist (Owner: QTL)

• SOPs for test, repair, final inspection; calibration records.
• REC category labeling; cosmetic grading guide posted.
• Parts provenance/traceability (no counterfeit); ESD program.
• Outgoing quality checks; RMA/warranty feedback loop into CAPA.

Show the auditor: traveler with test results, grading snapshots, calibration certificates, training, outgoing QC records.

---

Appendix D — Specialty Electronics Reuse

Plain‑English: Extra controls for specialized equipment (e.g., medical, lab, avionics, networking/carrier‑grade) where laws, safety, or calibration apply.

You need:

• Proof of competency, specialized tools, and access to service info.
• Compliance checks (licenses/authorizations, radiation, biohazards, patient data, etc.).
• Calibration and functional verification to appropriate standards before resale.

Checklist (Owner: QTL + EHS)

• Specialty device inventory and risk screen.
• Regulatory/standards map per device type; prohibitions documented when reuse is unsafe/illegal.
• Calibration records & labels; warnings/instructions included with sales.

Show the auditor: device‑type cheat sheets, competence records, calibration, outgoing documentation.

---

Appendix E — Materials Recovery

Plain‑English: Control your depollution and recovery processes so there are no uncontrolled releases and FMs get proper downstreams.

You need:

• Depollution steps before shredding; emission/effluent controls where applicable.
• Process parameters, maintenance, and monitoring records.
• Contracts/downstream verification for each commodity, especially FM fractions.

Checklist (Owner: OPS + EHS + DSV)

• Pre‑treatment/depollution work instructions (batteries, mercury, toner, PV laminate, etc.).
• Shredder or dismantling controls (guards, ventilation, fire suppression, feed limits).
• Sampling/analytics for output quality if claimed.
• Downstream verifications current; shipments match declared outlets.

Show the auditor: SOPs, maintenance logs, monitoring data, shipment files, downstream approvals.

---

Appendix F — Brokering

Plain‑English: Even if you never touch the goods, you still control them. Prove they went to qualified downstreams with correct categorizations and documents.

You need:

• Control and visibility from seller → downstream; accurate descriptions and REC categories.
• Contracts binding downstreams; qualification & monitoring like Appendix A.
• Records: chain of custody, shipping docs, exceptions & CAPA.

Checklist (Owner: DSV + LOG)

• Brokered transaction SOP (quotes, PO, descriptions, REC, DSV qualification).
• Documentary pack per shipment; exception workflow.
• Periodic monitoring of brokered downstreams.

Show the auditor: broker files, communications, contracts, downstream evidence.

---

Appendix G — Photovoltaic (PV) Modules

Plain‑English: Handle PV modules safely, evaluate for reuse, and manage unique FM and processing hazards; maintain tight traceability.

You need:

• PV hazards identification (electrical shock/energized circuits, glass breakage, laminates/chemicals); safe handling and storage.
• Testing/evaluation method (can include defined batch testing where allowed); routing to reuse or materials recovery with evidence.
• Downstream qualifications for PV reuse and recovery; traceability of all PV panels managed (including brokered).

Checklist (Owner: PVL + EHS + QTL + DSV)

• PV handling & electrical safety SOPs; trained/competent staff.
• Evaluation & test plan (functional/visual criteria); batch testing rules where applicable.
• Breakage/clean‑up & waste controls; FM identification for PV components.
• Downstream matrix for PV reuse, recycling, and residues; contracts & permits verified.
• Inventory & traceability logs for every PV module batch.

Show the auditor: PV risk assessment, training, test results, routing decisions, downstream files, inventory/traceability logs.

---

Auditor Interview Playbook (by clause)

Use these to prep supervisors/operators. Keep answers short and point to records.

• CR‑1: What is our R2 scope? Which appendices apply? → Show scope poster & certificate.
• CR‑2: How do you decide reuse vs recycling? → Describe triage and prohibited items list; show a recent routing example.
• CR‑3: Top 2 hazards at your station and the controls? → Name PPE/engineering controls; show training card.
• CR‑4: What permits affect your job? → Point to permit board/legal register.
• CR‑5: How do we know where this lot is and where it went? → WMS, traveler, mass‑balance.
• CR‑6: How do you assign REC categories? → Show workstation REC quick‑guide.
• CR‑7: How is access controlled here? What happens in an incident? → Access list, incident workflow.
• CR‑8: Where are Focus Materials and how are they stored? → Point to labeled, closed containers; inspection log.
• CR‑9: What do you check on the daily walkdown? → Aisles, density limits, battery checks.
• CR‑10: How do you select carriers and describe shipments? → Approved list, packaging SOP, codes.
• A–G: How do you qualify/monitor downstreams? Prove this panel/device was routed correctly. → Downstream matrix, qualification file, shipment docs.

Practical Tools

1) 90‑Day Implementation Plan (template)

Days 1–30

• Publish Scope; pick applicable Appendices; appoint clause owners.
• Build legal register; collect permits/licenses; freeze list of external controlled locations.
• Draft core policies (Hierarchy, Data Security, EHS policy) and top‑level SOP index.

Days 31–60

• Finalize evaluation/test SOPs with REC mapping; stand up throughput tracking and mass balance.
• Downstream mapping + initial qualifications; draft contract clauses.
• Facility controls walkdown; corrective actions list; battery & fire risk projects.

Days 61–90

• Train & qualify operators; run mock jobs end‑to‑end; generate sample records.
• Perform internal audit (R2/EHS/legal); open CAPAs; hold management review.
• Audit‑day rehearsal with evidence binder and floor tour script.

---

2) Audit‑Day Floor Tour Script (one‑pager)

• Intake → Quarantine/ID check → Evaluation (REC) → Data Area (B) → Test/Repair (C/D) → Depollution/Recovery (E) → Outbound Staging (A/F/10).
• At each stop: show SOP, training/competency, live records, controls, and last internal audit/CAPA relating to that area.

---

3) Records Map (sample)

Process	Record	Where	Retention
Intake	Receiving log, weights, photos	WMS/SharePoint	3+ years
Data Sanitization	Per‑device report, tool validation	DS portal	3+ years
Test & Repair	Traveler, test results, grading	QMS DB	3+ years
Downstreams	Qualification pack, contracts, monitors	DSV drive	3+ years
Throughput	Monthly mass balance	Ops folder	3+ years
EHS	Risk register, inspections, drills	EHS drive	per policy
Transport	BL/manifest, seal logs	Logistics	3+ years

---

4) Common Nonconformities & How to Avoid Them

• Scope drift: unlisted external storage/processing locations → keep the list public and current.
• REC mismatch: internal grades don’t map to REC → post the mapping and train.
• Downstream staleness: expired permits/certs in files → calendar reminders and annual reviews.
• Weak mass balance: missing WIP or adjustments → standardize variance thresholds and triggers.
• Data gaps: no per‑device trace for sanitization → enforce unique ID and completeness checks.
• Facility basics: blocked exits, unlabeled containers, poor battery storage → weekly 5S + photo logs.

---

5) Clause Owner Dashboard (monthly)

• Green: training ≥ 95% current; Amber: 80–94%; Red: < 80%.
• Mass‑balance variance: <2% Green; 2–5% Amber; >5% Red (investigate root causes).
• Downstream re‑quals due: list and due dates.
• Open CAPAs: count, oldest age, on‑time closure %.

---

Self‑Assessment & Readiness Scorecard

Score 0–2 for each item (0 = not in place, 1 = partial, 2 = robust). Aim ≥ 85% and no zeros before scheduling certification.

Area	Items
Governance	Scope posted; clause owners named; objectives set; management review held
Legal	Legal register complete; permits valid; import/export dossier template used
EHSMS	Risk assessments current; training ≥95% on‑time; emergency drill last 90 days
Throughput	REC captured; mass‑balance run quarterly; WIP aging controls active
Data Security	Secure area controls; per‑device trace; incident drill completed
Downstreams	Matrix current; qualification packs complete; contracts with R2 clauses
Test/Repair	SOPs & calibration; grading/REC alignment; outgoing QC
Materials Recovery	Depollution WI; shredder/vent controls; downstream verifications
Transport	Carrier vetting; packaging/segregation SOPs; seal logs
PV (if applicable)	PV risk/test plan; traceability; downstreams

Scoring rubric: 0 = missing; 1 = documented but inconsistent; 2 = documented + trained + records present.

---

Appendix: Quick Checklists You Can Print

Site‑Wide “Daily”

• Housekeeping walkdown; aisles/egress clear; battery storage checks.
• Data area access control functioning; visitor logs.
• Staging labeled by status; no mixing of incompatible materials.

Weekly

• Eye‑wash/shower checks; fire extinguishers; spill kits.
• Forklift & baler/shredder PM checks; guards in place.
• Random job back‑trace from inbound → outbound (throughput control).

Monthly

• Mass balance review; WIP aging purge plan.
• Downstream file spot‑check (permits/certs not expiring).
• Training matrix review; retrain/qualify as needed.

Quarterly

• Legal register review; update export/import dossiers.
• Emergency drill (rotate scenarios) + lessons learned.
• Management KPI review: incidents, CAPA, customer complaints/RTVs.

Annual

• Internal audit covering EHSMS + R2 + Legal; close CAPAs.
• Management review; objectives for next year.
• Closure plan refresh; financial coverage check.

---

Printable Templates

Copy these into your DMS as living forms.

• Downstream Qualification Pack Checklist — permits/licences; capabilities; certifications; FM handling; sub‑tier control; audit/monitoring plan; contract clauses.
• Import/Export Dossier Cover Sheet — classifications/codes; licensing/consents; receiving facility authorization; due‑diligence notes; copies of shipping docs.
• Mass‑Balance Workbook Tabs — Intake, Processing, FM, Outbound, Variance, WIP Aging, Notes/Assumptions.
• Sanitization Batch Report (Appendix B) — device ID/serial; method; verification result; operator; timestamps; hash (if applicable).
• Repair Traveler (Appendix C/D) — diagnostics performed; parts used; locks/firmware status; cosmetic grade; final test results; traceability to sanitization record.
• Facility Inspection (CR‑9) — aisles/egress; density limits; battery stations; fire systems; PM checks; photo log.
• Carrier Vetting Form (CR‑10) — licensing/insurance; scope; prohibited items; incidents; review date.

---

One‑Page Posters (make & post)

Create these as single‑page PDFs, laminate, and post at the relevant workstations.

1) Hierarchy of Responsible Management Strategies

Order of preference (always legal & safe): 1) Reuse → 2) Materials Recovery → 3) Disposal (last resort).
Never reuse: stolen, counterfeit, recalled, illegally imported/exported, or unsafe items.
Operator cues: If reusable per SOP → route to Test/Repair; if not → depollute FMs → materials recovery; document your decision on the traveler.

2) REC Quick‑Guide (per product family) — fill in your site’s mappings

Product Family	Example Acceptance for Reuse	Required Tests/Proof	Data Status	Cosmetic Grade	Your REC Category
Laptops	Boots to OS; battery health ≥ threshold	Keyboard, display, ports, battery, Wi‑Fi	Wiped/verified	B/C	[select]
Desktops	POST OK; no missing major parts	CPU/RAM/storage checks; ports	Wiped/verified	B/C	[select]
Smartphones	Unlockable; no activation lock	Screen, camera, battery, radios	Wiped/verified	B/C	[select]
Servers/Networking	Powers; passes vendor diag	Fans, ports, firmware, PSU	Wiped/verified	N/A	[select]
Displays	No cracks; acceptable pixel defects	Burn‑in, color, controls	N/A	B/C	[select]
PV Modules	Safe connectors; passes test plan	Visual + electrical checks	N/A	N/A	[select]

Replace [select] with your approved REC code per the official R2 Equipment Categorization. Keep a printed copy of the full REC table nearby.

3) Battery & PV Handling — Do’s / Don’ts

Batteries (esp. lithium):

• Do: tape/cap terminals; segregate by chemistry and state (intact vs. damaged); use approved containers; maintain spacing; inspect daily; keep spill/thermal event kit ready; train staff.
• Don’t: crush, puncture, over‑stack, mix damaged with intact, charge in staging, or store near heat sources.

PV modules:

• Do: assume energized; cover connectors; use glass‑safe lifting; store flat/secured; clean‑up broken glass per SOP; identify FM components before processing.
• Don’t: cut live wires; lean stacks unsecured; ignore micro‑cracks or delamination.

4) “Call Before You Ship” — Export/Transfer Checklist

• Receiving site authorized (permits/licences) and qualified in your downstream matrix.
• Correct classifications/codes and documentation prepared (include evidence of legality where required).
• Contract includes R2 obligations, FM handling, and sub‑tier controls.
• Packaging/segregation per SOP; no data‑bearing devices shipped without required status/proofs.
• Records pack assembled (shipping docs, permits/consents, contacts). If anything uncertain → call the DSV/LOG lead before dispatch.

5) Data Area — Golden Rules

• Access‑controlled: authorized, trained staff only; visitors escorted and logged.
• Chain of custody: every device has a unique ID; status visible (e.g., To‑Wipe/In‑Process/Verified/Failed).
• Approved methods/tools only; verification recorded for every device per SOP.
• No personal devices, photography, or unsecured notes in the data area.
• Incident? Stop, secure, report to DSL; complete incident log and follow response plan.

Final Reminders

• Keep it simple, visible, and provable. If you can’t show it, it didn’t happen.
• When you add a new process or product family, revisit Scope, REC mapping, hazards, downstreams, and training.
• Use internal audits as practice — the best time to find a gap is before the auditor does.