(1) The TSP must set out quality control procedures, including:
(a) details of how audits are scheduled; and
(b) the procedures for carrying out an audit; and
(c) the procedures for reviewing the TSP, including a process for consultation during such a review; and
(d) a description of the circumstances that will require a review of the TSP, including those surrounding the occurrence of an aviation security incident.
(2) An operator must:
(a) retain the records of an audit for 7 years; and
(b) retain the records of a review for 3 years.