R2 Guidance & Knowledge Base
An Auditor Guide to Incoming & Outgoing Transaction Sheets
Purpose of the R2v3 Transaction Sheets
The purpose of the transaction sheet is to provide the auditor with a work document that allows them to triangulate and correlate information related to the incoming and outgoing shipments/sales that are sampled to the requirements of the R2v3 Standard.
How to Choose a Sample
►Get Focused – Core 5
The R2v3 Standard provides the perfect requirements in Core 5, Tracking Throughput, to start the process of completing the transaction sheets. Core 5 requires detailed commercial records of transactions, and it also requires two summaries: Summary of Incoming, Summary of Outgoing. The Summaries are the place to start! Use the following topics to choose the initial sample:
- Scope – audit shipments that corroborate the scope of the R2 Facility. However, at the same time be on the lookout for shipments that may reflect the scope that needs to be expanded!
- Transboundary Movements – audit international movements, these are of considerable risk for meeting legal and regulatory requirements. Ensure the Legal Compliance Plan has identified and documented the applicable legal requirements of the exporting, transit, and importing countries to demonstrate the legality of a shipment under Core 4.
- Atypical / Unusual DSV Names, audit shipments where electronics are sent to companies whose names have words not related to used electronics recycling. For example: tires, automotive, and other non-related.
- Non-FM shipments, audit a small sample of non-FM shipments, remember proving the hierarchy for non-FMs means providing evidence that the hierarchy is established at the responsible management of said materials. Evidence could be provided in the way of contractual requirements with the vendor, vendor qualifications, invoice/purchase order with a positive value for materials, shipment records to a material recovery facility. The R2 Facility is responsible for demonstrating conformance to Core 4 and Core 2. Be on the lookout as well for FMs combined with non-FMs.
Completing the Transaction Sheets
►Key pieces of the Transaction “Puzzle”
An auditor should look at each part of the transaction as if it were a piece of a puzzle. Do ALL the pieces reflect an accurate picture of transaction, R2 Facilities scope, and the movements to each DSV?
Incoming Transaction Sheets
|
Transaction Record Type and Transaction ID |
Transaction Record Type examples: Invoice, Purchase Order, Packing List, BOL, Contract, Permit, Airway Bill, Seaway Bill, Train Manifest, Settlement Sheet, etc.
Transaction ID examples: unique identifier traceable to the incoming shipment, as taken from the transaction record type. This number can be an Invoice Number, BOL Number, Packing List Number, number assigned by the R2 Facility or by an EPR software to name a few. The number should be able to help identify other trails by correlating the same number to other documents. Feel free to add multiple numbers, that identify the one shipment, and designate which document the number came from. For Example – BOL Number SXC-1516, and Invoice Number DCF-01. *The form has space to include two different records for each transaction. The second record is optional but provides additional corroboration of the actual shipment details. |
| Transporter Name | The transportation company’s name for the incoming shipment. The transporter name is helpful when looking at Core 10 Transportation. Core 10 Transportation for the incoming applies when the R2 Facility is in control of the shipment. |
| Date | Choose the shipment date from the document(s) used to complete the section “Transaction ID.” This date is the shipment date, not to be confused with the received date. This date puts perspective on the expectation for dates on other records. For example, if a shipment came in on July 16, 2022, data sanitization records or other trails for your sample would be gathered from the R2 Facility post this date. Another audit trail where the date is an important connection is when a DSV was qualified. If an R2 Facility started receiving mercury containing devices in July 2022, the FM Management Plan would be updated as needed in accordance with Core 8. |
| Quantity | Quantity – This is the total by weight or piece designated for the entire Transaction. |
| REC Status | This status is dependent on what is coming in. Note that most of the time this status will be an R2 Controlled Stream because it is likely unevaluated equipment, components & materials. The new revision of the Transaction sheet now includes Functional. There may be more than one status applicable to an entire incoming shipment. Check all that apply. |
| Data Sanitization Status | If the status is pre-sanitized it is expected that an auditor will provide details on the specific sanitization process under the “Data Containing” section, and examples of the equipment and records reviewed. If the status is non-data, then data sanitization comments would reflect either 1) the device is a non-data device or 2) the records reviewed to demonstrate equipment came in already sanitized. The records reviewed to demonstrate equipment came in already sanitized could be an R2 supplier’s certificate and appropriate REC Categorization as sanitized, or records of sanitization from a non-R2, or internal sampling to verify sanitization, in any case, you should record specific samples for whatever the situation under Core 6(b)(2) is applicable. All equipment and components shall be evaluated for data, and data devices shall be secured and controlled. The R2 Facility needs to demonstrate this process. Check all that apply. |
| Cosmetic Condition Category (REC) or Equivalent |
This would not be applicable to equipment coming in like R2 Controlled Streams or Unrestricted Streams. It would be applicable if an R2 Facility received functional equipment. This might occur in the mobile industry or at an ITAD facility. This is not going to be applicable to most incoming shipments. Put NA if not applicable to the shipment. |
| Functioning Product Category (REC) or Equivalent |
This would not be applicable to equipment coming in like R2 Controlled Streams or Unrestricted Streams. It would be applicable if an R2 Facility received functional equipment. This might occur in the mobile industry or at an ITAD facility. This is not going to be applicable to most incoming shipments. Put NA if not applicable to the shipment. |
| Detailed Description | This description should be taken from one or more of the identified documents above, for that designated the transaction, demonstrating the unique equipment types and quantities. The description must be detailed to be able to triangulate information, ensure conformance to the FM Plan, and corroborate the scope. Remember the description can come from records created by the R2 Facility, such as settlement sheets, or other receiving records corroborating WHAT was received. What is received is critical in identifying the necessary controls later identified in the Appendices. For example, if a load of “used electronics” was received and identified as being scrap laptops and scrap printers, these would have trails associated to materials recovery for circuit boards, mercury tubes (from the laptop screen and scanner beds of printers), and batteries (lithium primary/button from the printer and lithium-ion from the laptop), in addition to physical sanitization of data (or potentially even logical sanitization if the hard drive was harvested and reusable). If the load of “used electronics” was received and identified as cell phones, and LED Monitors, the trails might be for test, repair, logical and physical sanitization, and later materials recovery for circuit boards and lithium-ion batteries. The Detailed Description is meant to provide connection to the applicable processes based on said description. |
| Sample of Unique Equipment IDs (If Applicable) |
This section would be applicable to equipment received under an ITAD management process or for equipment received as functional. Some shipments will have unique identifiers as part of an associated packing list. In this case you could record a SAMPLE of those IDs to trace to evidence related to test, repair, and data sanitization as appropriate to service being provided to the supplier or to identify conformance to test, repair, and data sanitization. Not all incoming shipments will have this connection. If there are unique IDs that require data sanitization or were sold as tested, these IDs should be reflected in the data sanitization and test and repair sections. |
| Supplier Name | It is the company the shipment came from. Name should be taken directly from the original commercial record. Supplier names can connect you to contractual requirements. In some cases, equipment is coming in from an R2 supplier categorized in accordance with the REC (or equivalent internal categorization), in this case connection to the R2 supplier’s certification status is key. |
| Supplier Location | Record the specific address from the commercial record. In some cases, equipment is coming in from an R2 supplier categorized in accordance with the REC, and again, in this case connection to the R2 supplier certification status is key. The R2 supplier would need to be certified to the specific address from the commercial record. |
| Supplier Contract Requirements | These are specific requirements for processing. What was the R2 Facility hired to do? Provision of data sanitization services (what type, physical/logical), materials recovery. Are there turnaround times for sanitization, requirements for not reusing, testing per supplier criteria, or other requirements? Contract requirements can be in emails, statements of work, or other documents. Audit evidence is usually held by the Sales Department, think quality on this one. |
| If International Shipment, Evidence of Verification of Legality, Core 4 |
Depending on the country in which you are auditing, the shipment may be coming in from another country. Check the supplier’s address; where does the shipment originate. If international, check the legal compliance plan and record the type of applicable legal requirements associated with the shipment. |
| Hierarchy of the Shipment, Core 2 | Is the incoming shipment slated for Reuse, Recovery, or Disposal? More than one might apply for an entire shipment. |
| If R2 Controlled, Evidence for Processes/Activities aligned with FM Plan, Core 8 | Record evidence that you see for the specific types of equipment and how they were processed. If there are many types of equipment, pick a sample. For example, with laptops, and printers, discuss the processes audited to manage these. Always be thinking of the scope as identified, are they doing and providing evidence to corroborate the scope. |
| Data Containing, Core 7 and Appendix B |
If the shipment was marked Pre-Sanitization, it would be expected that notes are in this section for the type of sanitization received, related to what was on the shipment, this is not generic information. If it is a load of printers that came in, what specific processes did you audit as related to the data sanitization plan. Historically R2 Facilities and auditors focus on hard drives and mobile phones leaving an enormous number of other devices that also contain data not audited like SD cards, SIM cards, IoT devices, etc. |
| Data Destruction Notes | From the types of devices received, the auditor may be able to trace specific IMEIs that came in, if that was a contracted process. If not received specific for sanitization, focus on auditing evidence that the devices received are being sanitized. If Sanitization is being done at the DSV level, record evidence when done by a Non-R2 DSV. If done by an R2v3 DSV, record name and scope of DSV in this section, reflective of data sanitization abilities. Sample a variety of device types, NOT JUST HARD DRIVES. |
| Test and Repair, Core 6 and Appendix C |
Check yes if the equipment received was coming in for test and repair or was functional when coming in from a supplier. Check no if equipment was not for test and repair. |
| Test and Repair Notes | If the Hierarchy for the shipment was noted as Reuse, it would be expected that there would be notes in this section. Again, refer to the types of equipment from the actual commercial record. What sample was audited for conformance to test and repair requirements, if the load contained printers, and laptops? Look at the test and repair for those devices. Or evidence of functionality from the supplier if devices were received as functional. |
Outgoing Transaction Sheets
| Transaction Record Type
and Transaction ID |
Transaction Record Type examples: Invoice, Purchase Order, Packing List, BOL, Contract, Permit, Airway Bill, Seaway Bill, Train Manifest, Settlement Sheet, etc. Transaction ID examples: unique identifier traceable to the outgoing shipment, as taken from the transaction record type. This number can be an Invoice Number, BOL Number, Packing List Number, number assigned by the R2 Facility or by an EPR software to name a few. The number should be able to help identify other trails by correlating the same number to other documents. Feel free to add multiple numbers, that identify the one shipment, and designate which document the number came from. For Example – BOL Number SXC-1516, and Invoice Number DCF-01.
*The form has space to include two different records for each transaction. The second record is optional but provides additional corroboration of the actual shipment details. |
| Transporter Name | The transportation company name for the outgoing shipment. The transporter name is helpful when looking at Core 10 Transportation. Core 10 Transportation applies either way for shipments whether under the control of the R2 Facility or not. For example, even if the R2 Facility was not paying for the outgoing shipping, if there were data containing devices on the load, they would have to ensure that the security requirements under Core 10 were met with the transporter. |
| Date | Choose the shipment date from the document(s) used to complete the section “Transaction ID.” This date is the shipment/sale date. This date puts perspective on the expectation for dates on other records. If a shipment went out on August 1, 2022; connect to when a DSV was qualified, were they qualified prior to being sent the shipment? Was the DSV Flow updated with SERI prior to the shipment if they register their DSV with SERI? You can check by reviewing the Downstream Vendor Report received email from SERI and checking that the File revision date and File version number are consistent with the updated qualified DSVs. |
| Quantity | This is the total by weight or pieces designated for the entire Transaction. |
| REC Status | This status is dependent on what is shipped out or sold directly to an end-user/buyer. The new revision of the Transaction sheet now includes Functional, that will apply for those going out with a C and F category. There may be more than one status applicable to an entire outgoing shipment. Check all that apply. |
| Data Sanitization Status | If a status was pre-sanitization, it is expected that an auditor will provide details on the sanitization processed being conducted by the DSVs. If it is checked non-data, a description of verified data sanitization is required for the equipment shipped/sold or evidence that it was a non-data device. Check all that apply. |
| Cosmetic Condition Category (REC) or Equivalent |
This would not be applicable to equipment shipped as an R2 Controlled or an Unrestricted Stream. It would be applicable if an R2 Facility was sending/selling functional equipment. Put NA if not applicable to the shipment, for example if the equipment being shipped/sold is for Materials Recovery. |
| Functioning Product Category (REC) or Equivalent |
This would not be applicable to equipment shipped as an R2 Controlled or an Unrestricted Stream. It would be applicable if an R2 Facility sending/selling functional equipment. Put NA if not applicable to the shipment. |
| Detailed Description from Commercial Record | This description should be taken from one of the identified documents above for that designated the transaction. The description must be detailed to conform to Core 5 of the Standard. This includes the types of equipment, components, and materials. Listing a description of used electronics does not indicate that the shipment was conforming to the details as required by the Standard, under Core 5. Remember the description can come from multiple records created by the R2 Facility, such as settlement sheets, or other receiving records corroborating WHAT was shipped. What is shipped is critical in identifying the necessary controls required at the DSV level. For example, a load of “used electronics” may contain scrap laptops and scrap printers, these would have trails associated to materials recovery for circuit boards, mercury containing equipment (from the laptop screen and scanner beds of printers), and batteries (lithium primary/button from the printer and lithium-ion from the laptop). In addition, a possible trail to physical sanitization of data if the devices were sent pre-sanitization. If the description is “used electronics” there are no ways to follow the described audit trails with specificity. If the load of was shipped and identified as cell phones and LED monitors, the trails might be for test, repair, logical and physical sanitization, and later materials recovery for circuit boards and lithium-ion batteries. The Detailed Description is meant to provide connection to the applicable processes based on said description. Look for data sanitization records and test records of lower value equipment being sold as functional. |
| Sample of Unique Equipment IDs (If Applicable) | This section would apply to equipment going for test and repair or being sold as functional. Some shipments will have unique identifiers as part of an associated packing list. In this case you could record a SAMPLE of those IDs to trace to evidence related to test, repair, and data sanitization as appropriate. This might provide evidence of how a service was provided to the supplier or to identify conformance to test, repair, and data sanitization requirements. Not all outgoing shipments will have this connection. |
| DSV/Buyer Name | The company name that the shipment is going to. Do not forget there may be an in between name, like a Broker that is identified on the commercial record. The name should be taken directly from the original commercial record. DSV names can connect you to DSV qualifications and FM Management Plan. Note: Per GDPR requirements for personal privacy, if the buyer is a person/user, feel free to abbreviate the name and address so as not to violate local data security requirements. |
| DSV/Buyer Address | Specific address from commercial record. An R2 DSV would need to be certified to the specific address from the commercial record. A Non-R2 DSV would be qualified to a specific address as well. Note: Per GDPR requirements for personal privacy, if the buyer is a person/user, feel free to abbreviate the name and address to not violate local data security requirements. |
| DSV Qualification Notes | These are specifics related to the qualification of a DSV specific to its processing. What was the DSV contracted to do? Provision of data sanitization services (what type, physical/logical), materials recovery. Connect the audit trails by potentially looking to contract requirements in emails, statements of work, or other documents reflecting what is done at the DSV. Connect the audit trails to the FM Management Plan processing /appendices. |
| If International Shipment, Evidence for Verification of Legality, Core 4 | If it is an international shipment, verify its legality in accordance with Core 4 – Depending upon the country where you are auditing, the shipment may be going to another country (export), or coming in from another country (import). Check the DSV’s address; where does the shipment end up? If international, check the legal compliance plan and record the type of legal requirements associated with the shipment. |
| Hierarchy of the Shipment, Core 2 | Is the outgoing shipment slated for Reuse, Recovery, or Disposal? More than one might apply for an entire shipment. |
| If R2 Controlled, Evidence for Processes/Activities aligned with FM Plan, Core 8 |
Record evidence that you see for the specific types of equipment and how they were processed at the DSV level. If there are many types of equipment, pick a sample. For example, with laptops, and printers, discuss the processes audited to manage these. Always be thinking of the scope of the DSV as identified, are they doing and providing evidence to corroborate the scope. |
| Data Containing, Core 7 and Appendix B |
If the shipment was marked Pre-Sanitization, notes are expected in this section for the type of sanitization being done outside of the R2 Facility. If marked non-data, then the notes should be reflective of the internal data sanitization records audited. |
| Data Containing Notes | First, consider the unique identifiers recorded. If the shipment was marked Pre-Sanitization, it would be expected that notes are in this section for the type of sanitization conducted by the DSV, related to what was on the shipment, this is not generic information. If it is a load of printers that went out, what specific processes did you audit as related to the data sanitization plan, and DSV qualification records? Historically, R2 Facilities and auditors focus on hard drives and mobile phones, leaving many other devices that also contain data not audited. If Non-Data focuses on the specific data sanitization records related to the UNIQUE types of equipment, remember not all devices are destroyed or sanitized with the same methods. |
| Test and Repair Core 6 and Appendix C |
Check yes if the equipment shipped/sold was going out functional. Check no if equipment was not functional. |
| Test and Repair Notes | Consider the unique identifiers recorded from data sanitization records, were test records also observed? If the Hierarchy for the shipment was noted as Reuse, it would be expected that there would be notes in this section. Again, refer to the types of equipment from the actual commercial record. What sample was audited for conformance to test and repair requirements? If the load contained printers, and laptops, look at the test and repair for those devices. |
