You need to assess a Legitimate Interest Assessment (LIA) test and document the outcome of the test so that you can demonstrate that legitimate interests apply. There are no specific rules on how to perform this. However, in practice, you should perform the LIA test, document the outcome, and then perform an audit of your decisions and justification for personal data processing.