Audit-ready evidence packs for compliance decisions

Eighteen months after a customer was approved, an examiner asks a simple question:

Show me why this decision was reasonable on the day it was made.

The compliance team finds a PDF marked "approved," an ownership chart, several documents in a shared folder, and a screenshot showing no sanctions matches. The officer who reviewed the case has left. The screening provider has changed its interface. The policy has been revised twice. Nobody can tell which document version the reviewer saw, what query produced the screenshot, whether a missing item was resolved, or why the reviewer accepted the final risk.

The file contains evidence. It does not contain the decision path.

An audit-ready evidence pack is not a prettier archive and not a PDF generated when an auditor arrives. It is a controlled representation of the work as it happened. Its test is demanding but practical:

Can another authorised officer reconstruct the material facts, the applicable standard, the unresolved uncertainty, the human intervention, and the final decision without relying on the original reviewer's memory or access to the original workflow?

If the answer is no, the pack may document an outcome. It does not preserve the decision.

The weak pack that fails

The following scenario is synthetic. It is not a customer case, a statement about any institution's controls, or a claim of product performance.

Tern Maritime Components AG was approved after a KYC review. The retained export contains:

• a cover page with the customer name and "Approved";
• a commercial-register extract;
• a customer-supplied ownership chart;
• a sanctions-screening screenshot marked "No hits";
• the reviewer's initials;
• a SHA-256 value for the exported PDF.

At first glance, the export looks organised. Under examination, it fails quickly.

The commercial-register extract has no retrieval timestamp and no record of the issuing source. The ownership chart has no effective date and no distinction between customer assertions and independently established relationships. The screen does not show the identifiers submitted, aliases used, lists checked, list version, provider response, or query time. The approval has no policy version, no rationale, and no indication of whether the initials belong to the maker, checker, or final decision-maker.

A note in a separate email says, "UBO document outstanding, accepted for now." The pack does not identify the missing document, who accepted the gap, why alternative evidence was sufficient, whether the acceptance expired, or whether the item ever arrived.

The SHA-256 value does one useful thing. If the institution retained the exact reference value through a trusted process, it can hash the PDF again and compare the result. A match supports the conclusion that the captured bytes have not changed since that value was generated.

It does not prove that the registry extract was authentic. It does not prove the ownership chart was correct on the decision date. It does not prove the pack contains every event. It does not establish that the reviewer saw the same source documents. It does not turn "No hits" into a reproducible search. It does not prove historical truth.

The weak pack fails because it seals an incomplete summary. Integrity cannot repair missing provenance or missing judgment.

A complete pack preserves different kinds of knowledge

Now replay the same synthetic decision using a record designed for reconstruction.

The first improvement is semantic. A complete pack does not flatten every statement into "evidence." It keeps at least five kinds of knowledge distinct:

Those labels prevent a common audit problem. A reviewer can see whether a conclusion came directly from an authoritative record, from a deterministic comparison, from an analytical inference, or from human discretion. The pack can be challenged at the right layer.

If the registration number was extracted incorrectly, the source can resolve the fact. If the relationship inference joined two different entities, the identity evidence can be challenged. If the facts were right but the risk was accepted too readily, the human judgment and governing policy can be reviewed. "The system said so" is never the only explanation.

The reconstruction starts with scope, not documents

The complete pack opens by defining what was decided.

The reconstruction principle is not invented by software vendors. FATF Recommendation 11 says financial institutions should keep transaction records sufficient to permit reconstruction and retain CDD records, account files, business correspondence, and results of analysis under the standard's record-keeping period. In Switzerland, FINMA states that investigations into unusual transactions or relationships under the special due-diligence duties must be documented so third parties can reach a well-founded judgment. The exact obligation, retention period, and competent authority depend on the institution and jurisdiction. The operating requirement is still clear: a conclusion needs a record another qualified person can examine.

For Tern, it records the assessment type as legal-entity KYC onboarding, the subject and identifiers, relevant jurisdictions, the decision date, the risk method, and the exact policy version used. It states which sanctions and PEP sources formed the required screening set under that policy and whether enhanced due diligence applied. It identifies material exclusions and limitations.

This is the frame for every later artifact. Without it, an examiner cannot tell whether a missing check was out of scope, unavailable, or forgotten. A record created under policy version 4.2 should not be judged as if the reviewer silently used version 5.0. A later policy may reveal that the earlier control was weak, but the historical decision still has to be reconstructed under the standard actually in force.

Scope also makes negative claims precise. "No sanctions exposure identified" must mean no exposure identified within a defined party set, ownership depth, source set, query configuration, date, and evidence limit. The pack should not turn that bounded conclusion into "the customer had no sanctions exposure."

Every material fact needs a route back to a source

The complete Tern pack contains a source inventory, not merely attachments.

For each material source it records the issuer or provider, source type, original location or reference where appropriate, retrieval time, issue and expiry dates where relevant, relationship to the assessed party, language and translation status, and a content hash captured at ingestion. It distinguishes originals from derived files and identifies superseded material rather than deleting it.

The official register establishes legal existence and collective signing authority. A certified shareholder register establishes the direct owners as of the relevant date. A beneficial-owner declaration provides the customer's assertion. A shareholder agreement supplies control rights not visible in the public registry. A screening-provider response records the parties and lists checked. A distributor contract supports the intended activity.

Extracted facts point back to those specific source records. If two sources disagree, the contradiction remains visible. The pack shows that the customer chart reported one owner at 24 percent while the current shareholder register recorded 31 percent after a transfer. It preserves both statements, the effective dates, and the evidence used to resolve the conflict.

This is why provenance must be captured during the assessment. If the team waits until examination to rebuild it, links between facts and sources will be inferred from filenames, folder dates, and memory. That reconstruction may be plausible. It is not the same record the decision-maker relied on.

A screening result must be reproducible as a historical event

The weak screenshot said "No hits." The complete pack records a query.

It identifies every screened party, the legal name and aliases submitted, distinguishing identifiers, provider, list names, list version or snapshot timestamp where available, execution time, query terms, method or threshold where material, raw response or source record, resulting hits, and the disposition history.

That lets a later reviewer understand what the result meant on the decision date. Re-running the name today is useful for current risk, but it does not reproduce the historical event. Lists change. Providers change matching logic. New aliases appear. A current hit cannot prove that the original search should have produced the same result, and a current clear cannot prove what was available eighteen months ago.

For Tern, the historical query produced a possible match on one director. The maker initially disposed it as a different person based only on a different address. The checker returned the case because the birth year and nationality were still compatible. A targeted RFI obtained a passport copy and full date of birth, which excluded the listed person. The revised disposition links the identifiers and source that resolved the hit.

The final pack therefore does not say only "No hits." It shows one potential hit, a human challenge, additional evidence, and a reasoned disposition.

Missing evidence must leave a visible decision

Tern's file also contains an ownership gap. A certified copy of an older trust instrument cannot be obtained before sign-off. Current trustee records, a regulator-issued extract, and a newer executed deed establish the present controller, but the older document would have clarified the exact date of an earlier change.

The RFI history records what was requested, why it mattered, when it was sent, what was returned, and whether the response was accepted. The maker proposes that the missing historic copy is not material to the current controller conclusion. The checker challenges the date boundary and asks whether any transaction under review predates the newer deed. The answer is no. The checker accepts the gap under the institution's policy, records the alternative evidence, limits the acceptance to the current onboarding decision, and requires the missing instrument if a historic transaction is later assessed.

Accepted evidence gaps require rationale and accountable approval.

A pack that hides the gap gives the appearance of completeness. A pack that merely lists it as "outstanding" omits the judgment. The audit-ready record preserves both the uncertainty and the reason the decision could still proceed.

Human intervention is part of the evidence

An outcome can be reconstructed only if the review path shows who had authority and how the work changed.

The complete pack identifies the maker, checker, and any MLRO or specialist reviewer by accountable role. It records the proposal, return, resubmission, escalation, override, approval, or rejection with timestamps and rationale. It shows the open RFI and unresolved-hit counts at material decision points. It preserves the evidence snapshot that the final reviewer saw.

In the synthetic case, the maker proposes approval at standard risk. The checker returns the case for two reasons: the director hit is under-supported and the ownership-transfer date conflicts across sources. After the RFI responses arrive, the maker revises the screening disposition and changes the risk proposal to higher risk because of the trust structure. The checker approves with a twelve-month refresh and a change trigger for trustee or control-right updates.

The value is not that two people clicked buttons. It is that the second review changed the work. The record shows the challenge, the new evidence, the changed recommendation, the authority of the final reviewer, and the conditions attached to approval.

Human-in-the-loop becomes meaningful when the intervention is visible enough to examine.

Version history protects the decision from later improvement

Compliance records often become less truthful as teams improve them. A stale document is replaced. A rationale is clarified. A source link is repaired. A new ownership chart is uploaded over the old one. The current file becomes better, but the historical decision becomes harder to reconstruct.

An audit-ready design uses versions and snapshots.

Tern's decision pack version 1 contains the maker's original proposal. Version 2 contains the checker return and new RFI evidence. Version 3 is the signed decision state. The evidence pack identifies the pack version, generation time, applicable schema or contract version, and the source snapshot included. Later reassessment creates a new decision lineage rather than rewriting version 3.

Exports should identify which pack and version they contain. Access and export records should show who requested the material, when, for what authorised purpose where required, and which artifact set was delivered. Access logging does not prove the recipient used the evidence correctly, but it helps establish custody and accountability.

The principle is simple: improvement should append context, not alter the past unnoticed.

Integrity is necessary, bounded, and often overstated

The NIST Secure Hash Standard specifies algorithms that generate message digests used to detect whether messages have changed since the digests were generated. That is the relevant claim.

At capture time, a hash can be computed for a source artifact. Later, the same bytes can be hashed and compared with the retained reference. A different value indicates that the bytes differ. A matching value supports later integrity verification of the captured artifact.

A linked sequence can extend this control to recorded events. If each event hash covers its sequence number, content, and the previous event's hash, a later insertion or modification within the captured chain should cause verification to fail from that point.

But the limit is decisive:

A valid hash chain supports verification of the internal linkage and unchanged content of the events it contains. It does not prove that every event that should have existed was emitted into the chain.

If a reviewer override was never recorded, there is nothing for the hash to protect. If an integration silently dropped an RFI-closure event before append, the remaining events can still form a mathematically valid chain. A chain cannot prove the existence of omitted history.

Coverage therefore needs its own controls: defined event types, reliable event generation, sequence expectations, reconciliation between business records and audit events, visible dispatch failures, and tests that material actions always create the required record. NIST's current SP 800-171 Rev. 3 audit and accountability controls make the underlying point explicit by requiring organisations to define event types for logging and protect audit information from unauthorised modification or deletion.

Integrity is not authenticity. A perfectly preserved forged document is still forged. Integrity is not completeness. A perfectly linked partial log is still partial. Integrity is not truth. A customer assertion does not become a verified fact because its PDF hash matches.

An honest evidence pack states those limits.

The complete pack survives the reconstruction test

Return to the examiner's question: why was Tern approved on that date?

Another authorised officer can now work through the answer without the original reviewer:

1. Confirm the assessment scope, applicable policy version, party set, and relevant date.
2. Verify the captured artifacts against their retained hashes and inspect source provenance and limitations.
3. Trace each material fact to its source and review contradictions and effective dates.
4. Reconstruct the historical screening query and every hit disposition from the stored query and response context.
5. Follow RFIs from request through returned evidence and acceptance.
6. See where the checker intervened, what evidence changed, and why the risk proposal changed.
7. Confirm the final reviewer, role, authority, rationale, conditions, and evidence snapshot at sign-off.
8. Verify the captured event chain and examine the separate evidence that required events were covered.
9. Distinguish the signed historical decision from later reassessment or corrected facts.

The second officer may disagree with the original judgment. Reconstructability does not require agreement. It requires enough faithful evidence to understand what was known, what remained uncertain, which rule or policy was applied, and who accepted the consequence.

That is what the weak pack could not do. It preserved a conclusion. The complete pack preserves a reviewable decision.

Evidence should be assembled by the work itself

The usual audit burden exists because the operating workflow and the evidence archive are separate. Teams do the work in screening tools, email, shared drives, ticket queues, spreadsheets, and human memory. Later, they assemble selected fragments into a report.

cmpliance is assembling a different sequence. Current components retain source records and source-linked facts, screening-query and disposition context, RFIs, assessment transitions, reviewer roles, rationale, and reviewed snapshots. Separate evidence-pack components can assemble those records with artifact and manifest hashes, version identifiers, and audit-chain verification; current evidence does not yet prove every acquisition, document-extraction, screening, RFI, review, audit-capture, and pack step as one continuous production path. Human decisions remain attributable to signed-in reviewers and the applicable authority path.

The product does not make a hash prove truth. It does not make a pack complete merely by exporting it. The operating model is to create the record during the assessment, expose missing or degraded evidence before sign-off, preserve the human challenge, and package the resulting chain for independent review.

This completes the sequence that began with why compliance teams should make decisions rather than gather evidence, then examined what agents investigate and where human judgment enters.

The final product is not proof that the decision was infallible. It is evidence that the decision can be examined.

Agents do the work. Humans make the call.

Talk to cmpliance