Chapter 48 — Evidence dossier
Lesson map
Lesson 48 published. Map, example, EX142.
flowchart TD
N0["Learning outcomes"]
N1["48.1 Assembling"]
N2["48.2 Manifest and mismatch"]
N3["Lab — Detecting a changed evidence file"]
N4["48.3 Handling changes"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX142"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["48.1 Assembling"]
N2["48.2 Manifest and mismatch"]
N3["Lab — Detecting a changed evidence file"]
N4["48.3 Handling changes"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX142"]
[Learning outcomes]
|
v
[48.1 Assembling]
|
v
[48.2 Manifest and mismatch]
|
v
[Lab — Detecting a changed evidence file]
|
v
[48.3 Handling changes]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX142]
Learning outcomes
You will (1) assemble an evidence dossier for a governance programme; (2) protect it with a digest manifest; (3) detect and explain changes.
48.1 Assembling
For her thesis and for Ardwell's auditors, Nadia assembles an evidence dossier: the risk register extract, quarterly control test results, the statement of applicability and board minutes approving risk appetite. Each item has a source, date and owner. She writes a short index explaining what each item proves and how it links to requirements. She learns that a dossier is an argument, not a pile of files: it should let a reader follow the claim that controls work back to evidence. The index, for example, links the board minutes to the claim that risk appetite was formally approved.
48.2 Manifest and mismatch
Nadia computes a digest for each file and stores the manifest separately. Weeks later, she rechecks. Three files match, but the control test results do not: the lab shows a mismatch for that file. Investigation reveals that a test owner had edited the file to change forty-five passed tests to forty-seven after rerunning two tests. The change might be legitimate, but editing evidence in place destroys the record of the original result. The change from forty-five to forty-seven passed tests may reflect real retests, but the original result is no longer visible in the file.
Lab — Detecting a changed evidence file
"""Evidence dossier manifest: detect a changed file by SHA-256 (synthetic contents)."""
import hashlib
files = {"risk_register.csv": "R01,IT ops,12\nR02,Finance,8\n", "control_tests.csv": "access,48,45\n",
"soa.md": "Statement of applicability v3\n", "board_minutes.md": "Risk appetite approved\n"}
man = {f: hashlib.sha256(c.encode()).hexdigest()[:12] for f, c in files.items()}
files["control_tests.csv"] = "access,48,47\n"
for f in sorted(files):
now = hashlib.sha256(files[f].encode()).hexdigest()[:12]
print(f, man[f], "OK" if now == man[f] else "MISMATCH")
Run with python3 lab_dossier.py. Verified output:
board_minutes.md a112873ae77e OK
control_tests.csv 33fdcc0a788f MISMATCH
risk_register.csv 5e0ebfd61225 OK
soa.md ac050567962d OK
48.3 Handling changes
Nadia restores the original file from the archive and asks the owner to file the retest as new evidence with its own date, so both results remain visible. She updates the procedure to forbid editing filed evidence. She notes that digests detect change but cannot say whether a change was honest. Prof. Brenner explains that integrity of evidence underpins every assurance claim, and that mature programmes treat evidence as append-only, recording corrections as new entries. Filing the retest as new evidence keeps both the forty-five and forty-seven results traceable for the auditors.
Worked example
Nadia builds an indexed dossier, detects a changed test file through its digest and restores append-only handling.
Synthetic case. Dossier contents are synthetic.
Errors and limits
Digests prove change, not intent. Manifests must be protected too.
Exercises
- EX142 — Dossier as argument. Why is a dossier an argument rather than a pile of files? Rubric: 3 = it lets readers trace claims back to evidence;; 2 = traceability;; 1 = vague;; 0 = none.
- EX143 — Mismatch file. Which file showed a mismatch? Rubric: 3 = control_tests.csv;; 2 = test results;; 1 = vague;; 0 = none.
- EX144 — Correct handling. How should a retest be recorded? Rubric: 3 = as new evidence with its own date;; 2 = append;; 1 = edit in place;; 0 = none.
Synthesis
Evidence dossiers need indexes, digest manifests and append-only handling.
Continue studying — chapter 48 of 50
← Chapter 47 (draft) · Course chapter index · Chapter 49 (draft) →