We don't know how exposed our records actually are
No one has ever scored the practice against what a dispute would ask for.
What's happening?
Everyone suspects the records would embarrass them if a dispute landed - and because nobody knows by how much, nothing gets fixed. The discomfort is general, so the work to cure it never gets a shape or a budget, and the practice carries on hoping the test never comes.
Exposure is not a mood, it is a list. A dispute asks for specific things: the contemporaneous diary, the notice served inside its window, the application-and-certificate history, the cost records behind each head of a claim. Each one has a could-we-produce-it-today answer, and scoring those answers honestly turns a vague unease into a ranked set of gaps - which is the difference between worrying about records and having a plan for them.
The scorecard is that exercise in template form: the questions a dispute would ask, scored in an afternoon, with the worst scores first in the queue.
The solution
Score it honestly once, and the gaps become a plan.
If you would rather it were done for you, Business Systems Review is the service that does it.