A privacy program manager compiles a quarterly privacy dashboard for the steering committee using data pulled from the ticketing system (data subject requests), the incident register, and vendor assessment logs. During review, a committee member questions whether the reported 'average DSAR response time of 12 days' can be trusted, noting that several requests were logged manually after the fact and some were closed without a documented completion date. What should the privacy manager do FIRST to address this concern?