FIELD GUIDE

Evidence quality & working papers

A client's statement is useful discovery information. It becomes a defensible conclusion only when the evidence is strong enough for the claim being made.

Relevant

Does the artefact actually support the claim being made?

Current

Does it match the live system/version and the period being assessed?

Attributable

Can you identify the source, owner, approver and date?

Sufficient

Is it enough to support the consequence of the conclusion?

Operational

Does it show the control actually worked, not only that it was designed?

Consistent

Does it agree with interviews, logs, contracts, configuration and other evidence?

Example: human oversight

Claim

A human reviews every AI-generated shortlist before candidates are rejected.

Weak evidence

A policy saying human review is required.

Better evidence

Procedure + reviewer training/competence + sampled review records + overrides/escalations + workflow/configuration evidence.

Possible conclusion

Control is designed and appears to operate for the sampled period, subject to stated sampling limits.

Working-paper discipline

✓Separate facts, assumptions, interpretations and final conclusions.
✓Give every material decision a date, owner/reviewer and evidence link.
✓Record system/model version where a change could affect the conclusion.
✓If evidence is missing, record the gap and what would close it instead of assuming completion.
✓Retain why a conclusion changed when new evidence or updated guidance arrives.
✓Write limitations so the reader knows what the evidence does not prove.
✓Use neutral finding language: ‘we have not yet seen evidence that…’ rather than personal blame.

Evidence chain

Use the mental model: claim → evidence → owner/source → date/version → analysis → conclusion → limitation/action. Another reviewer should be able to reproduce the reasoning.