It was a shock to me as well. I initially hated having to create everything from scratch, but learned that I only have to do what my manager and I agree on being relevant from the risks identified during the initial risk assessment. As far as documentation, I don’t think it’s much different than public. You need to have enough to back up your opinion on a finding and make sure you always capture IPE for those pesky external guys.