diff --git a/atst/routes/portfolios/task_orders.py b/atst/routes/portfolios/task_orders.py
index 0615ebda..f9ef106f 100644
--- a/atst/routes/portfolios/task_orders.py
+++ b/atst/routes/portfolios/task_orders.py
@@ -88,8 +88,8 @@ def ko_review(portfolio_id, task_order_id):
     "/portfolios/<portfolio_id>/task_order/<task_order_id>/review", methods=["POST"]
 )
 def submit_ko_review(portfolio_id, task_order_id, form=None):
-    Authorization.check_is_ko(g.current_user, task_order)
     task_order = TaskOrders.get(g.current_user, task_order_id)
+    Authorization.check_is_ko(g.current_user, task_order)
     form = KOReviewForm(http_request.form)
 
     if form.validate():
diff --git a/tests/routes/portfolios/test_task_orders.py b/tests/routes/portfolios/test_task_orders.py
index ed2f1c82..48d4aa21 100644
--- a/tests/routes/portfolios/test_task_orders.py
+++ b/tests/routes/portfolios/test_task_orders.py
@@ -68,41 +68,6 @@ class TestPortfolioFunding:
             assert context["total_balance"] == active_to1.budget + active_to2.budget
 
 
-def test_ko_can_view_task_order(client, user_session):
-    portfolio = PortfolioFactory.create()
-    ko = UserFactory.create()
-    PortfolioRoleFactory.create(
-        role=Roles.get("officer"),
-        portfolio=portfolio,
-        user=ko,
-        status=PortfolioStatus.ACTIVE,
-    )
-    task_order = TaskOrderFactory.create(portfolio=portfolio, contracting_officer=ko)
-    user_session(ko)
-    response = client.get(
-        url_for(
-            "portfolios.view_task_order",
-            portfolio_id=portfolio.id,
-            task_order_id=task_order.id,
-        )
-    )
-    assert response.status_code == 200
-
-
-def test_can_view_task_order_invitations(client, user_session):
-    portfolio = PortfolioFactory.create()
-    user_session(portfolio.owner)
-    task_order = TaskOrderFactory.create(portfolio=portfolio)
-    response = client.get(
-        url_for(
-            "portfolios.task_order_invitations",
-            portfolio_id=portfolio.id,
-            task_order_id=task_order.id,
-        )
-    )
-    assert response.status_code == 200
-
-
 class TestTaskOrderInvitations:
     def setup(self):
         self.portfolio = PortfolioFactory.create()
@@ -151,3 +116,59 @@ class TestTaskOrderInvitations:
 
         updated_task_order = TaskOrders.get(self.portfolio.owner, self.task_order.id)
         assert updated_task_order.so_first_name != "Boba"
+
+
+def test_ko_can_view_task_order(client, user_session):
+    portfolio = PortfolioFactory.create()
+    ko = UserFactory.create()
+    PortfolioRoleFactory.create(
+        role=Roles.get("officer"),
+        portfolio=portfolio,
+        user=ko,
+        status=PortfolioStatus.ACTIVE,
+    )
+    task_order = TaskOrderFactory.create(portfolio=portfolio, contracting_officer=ko)
+    user_session(ko)
+    response = client.get(
+        url_for(
+            "portfolios.view_task_order",
+            portfolio_id=portfolio.id,
+            task_order_id=task_order.id,
+        )
+    )
+    assert response.status_code == 200
+
+
+def test_can_view_task_order_invitations(client, user_session):
+    portfolio = PortfolioFactory.create()
+    user_session(portfolio.owner)
+    task_order = TaskOrderFactory.create(portfolio=portfolio)
+    response = client.get(
+        url_for(
+            "portfolios.task_order_invitations",
+            portfolio_id=portfolio.id,
+            task_order_id=task_order.id,
+        )
+    )
+    assert response.status_code == 200
+
+
+def test_ko_can_view_ko_review_page(client, user_session):
+    portfolio = PortfolioFactory.create()
+    ko = UserFactory.create()
+    PortfolioRoleFactory.create(
+        role=Roles.get("officer"),
+        portfolio=portfolio,
+        user=ko,
+        status=PortfolioStatus.ACTIVE,
+    )
+    task_order = TaskOrderFactory.create(portfolio=portfolio, contracting_officer=ko)
+    user_session(ko)
+    response = client.get(
+        url_for(
+            "portfolios.ko_review",
+            portfolio_id=portfolio.id,
+            task_order_id=task_order.id,
+        )
+    )
+    assert response.status_code == 200