(1) The authority must review the internally reviewable decision.
(2) The review must happen within 28 days (the 28-day period ) after the day the authority receives the application for review of the internally reviewable decision.
(3) The authority must—
(a) confirm the decision; or
(b) vary the decision; or
(c) set aside the decision and substitute another decision.
(4) If the decision is not varied or set aside within the 28-day period, the decision is taken to have been confirmed by the authority.