What you need to know

Module 2 is the most common audit fail point. Providers without a documented risk register or incident process get caught here.