What evidence does an R2v3 audit actually review?

The audit reviews your whole management system, but the records-heavy core is: serial-level tracking from receipt to final disposition, data-sanitization records per device or lot with quality-control verification, the sampling evidence behind that verification, downstream-vendor due-diligence files, outbound shipment records, and the documentation tying your written procedures to what the floor actually did.

How often are R2v3 facilities audited?

Certification runs on a three-year cycle with surveillance audits in between, so a facility is audited every year — and the R2 program also provides for unannounced audits. Practically, that means evidence has to be producible on any given day, not assembled for a scheduled date.

Why do spreadsheets struggle with R2v3 evidence?

A spreadsheet records what someone remembered to type, after the fact, with no enforcement. It cannot stop a drive from moving to the next stage without a sanitization record, cannot prove a cell wasn't edited last week, and reconciling spreadsheet rows against certificates, photos, and shipment paperwork is exactly the assembly work that consumes audit-prep time.

What does 'continuously audit-ready' mean?

That the evidence for any device is complete at the moment its processing is complete — records created at the point of work, timestamps applied by a server rather than typed by hand, gates that physically prevent skipped steps, and files an auditor can follow without a guide. If producing evidence requires a preparation project, the facility is not continuously audit-ready.

The Hidden Production Line: What R2v3 Audit Evidence Actually Costs to Assemble

By W. Miller, TetraCore

Every R2v3-certified facility runs two production lines. The first one processes devices: receive, sanitize, test, repair, ship. The second one produces proof that the first one happened correctly. The first line earns the revenue. The second line keeps the certificate that makes the revenue possible — and in most facilities, nobody has ever measured what it costs.

The second production line is real work

Talk to the people who prepare a facility for its surveillance audit and a familiar list emerges. Serial-level custody records have to reconcile — every device received matched to a disposition, with the trail in between intact. Sanitization evidence has to exist per device or per lot, and it has to agree with the erasure tool's certificates. The quality-control sampling behind that evidence has to be documented, including who verified what and when — and the verifier can't be the person who did the sanitizing. Downstream-vendor files need current certifications and due-diligence records. Outbound shipments need paperwork connecting specific units to specific vendors.

None of this is optional, and none of it is exotic — it's what the certification means. The question is only when the work happens: continuously, as a byproduct of processing, or in a concentrated push before the audit.

The concentrated-push model, honestly described

In the push model, the floor runs on some mix of spreadsheets, the erasure tool's own logs, paper travelers, and a shared drive of photos. It works, in the sense that devices get processed. Then an audit approaches, and someone — usually the compliance manager, often the owner — spends days or weeks turning that mixture into an evidence package: reconciling spreadsheet rows against certificates, chasing down the photo of the pallet that somebody took on their phone, reconstructing why a device that appears in receiving never appears in shipping.

Three things are true about this model:

The cost is invisible because it's episodic. Nobody budgets "three weeks of the most senior compliance person's year" as a line item, but that's what it is — recurring, every year, forever.
The assembly itself degrades the evidence. Records assembled long after the fact, with hand-typed dates and reconstructed sequences, are simply weaker than records created at the moment of work. Auditors know the difference.
It has a failure mode with teeth. A gap found during assembly — a missing sanitization record for a shipped lot, say — is now a finding you discovered on the auditor's schedule instead of your own.

Why the spreadsheet is the bottleneck

The spreadsheet isn't failing at recording; it's failing at enforcing. A tracking sheet cannot stop a drive from leaving the sanitization bench without a passing record. It cannot require a photo before a stage change. It cannot prove that a cell said the same thing last month. It cannot select a random verification sample, and it certainly cannot guarantee the verifier was independent of the operator. Every one of those gaps becomes human vigilance — and human vigilance is exactly what a busy floor runs short of first.

This is the structural argument for workflow enforcement: when the system physically gates stage transitions on the evidence existing, the second production line stops being a separate job. The record isn't about the work. It is the work, captured as it happens, with timestamps applied by a server instead of a memory.

A test you can run this week

Pick one device your facility shipped last quarter — not a cherry-picked one, an ordinary one. Now assemble its complete story: when it arrived and from whom, every hand it passed through, its sanitization record and the certificate behind it, whether it landed in a verification sample, the photos that document its condition, which vendor received it and what that vendor's certification status was on the ship date.

Time the exercise. If the answer is minutes, your evidence system is working. If the answer is an afternoon of cross-referencing — or "we'd need to ask Dana, she has the spreadsheet" — you've just measured your second production line, and you've measured it under friendly conditions, without an auditor watching.

The industry context

This burden is about to be carried by more facilities than ever. Our analysis of the SERI directory counts 789 active R2v3 facilities in the US as of August 2026 — and 30% of them earned their first certification in 2024 or later. That's hundreds of operations building their evidence processes right now, deciding between the spreadsheet-and-push model and something enforced. The facilities that pick enforcement early get a compounding benefit: every year of operation deepens an audit trail that assembled itself.

For how ItemStage implements the enforcement side — sanitization gating, independent sampling, vendor controls — see the ITAD overview.