Zohar,
What I would do is go off to the side with them and have them correct it (and actively watch). By being active with the player, you shut off avenues of Cheating and you have a clear path to detection.
You can watch them and check to see what they are siding in/out. If they seem like they are presideboarding, you now have avenues to explore:
-Ask them why they maindeck those cards. They should be able to tell you why.
-You can take what you've written down about what they moved, then run and check it vs their decklist.
-You can pull their decklist, and you can SB check them once they fix it. If you're concerned about the walk, you can pull their SB, fan it out on another table, take a picture, return it, then go pull their decklist and check.
You have some investigation, and physical evidence that you can then take to the HJ to alert them of Cheating.
In the more common case of “the player knows and can fix it, and does so”, you've minimized the time spent vs going through the decklist. By being active, you also present a better image to the player. They are aware of you trying to help vs you just being there to give them a penalty.
I'd highly recommend Eric Shukan's outstanding articles on investigations:
https://blogs.magicjudges.org/articles/2014/12/30/investigations-the-search-for-collateral-truths/https://blogs.magicjudges.org/articles/2015/01/06/investigations-the-search-for-collateral-truths-part-2/https://blogs.magicjudges.org/articles/2015/01/13/investigations-the-search-for-collateral-truths-part-3/