Chapter 3 — Authorized practice and evidence handling
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Written authorisation"]
N2["3.2 Handling evidence"]
N3["3.3 Respecting donor privacy"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Written authorisation"]
N2["3.2 Handling evidence"]
N3["3.3 Respecting donor privacy"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 Written authorisation]
|
v
[3.2 Handling evidence]
|
v
[3.3 Respecting donor privacy]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) obtain and follow written authorisation; (2) handle evidence with integrity; (3) respect privacy of donors.
3.1 Written authorisation
Before reviewing the treasury setup, Marcus obtains written authorisation from the director describing the scope: read-only review of the treasury configuration and transaction history, the donation records and procedures, using synthetic test transactions on a test network where testing is needed. It excludes moving any real funds, contacting donors and testing the exchange's systems. The document names who to contact if he finds something urgent. Authorisation protects Marcus and the charity, and it clarifies expectations so that everyone knows what he will and will not do.
3.2 Handling evidence
Marcus collects evidence directly from sources: transaction history exported from a block explorer for the treasury address, configuration screenshots from the multisig interface and donation records from the finance system. He records the time, source and method for each and stores a SHA-256 hash of every exported file. He keeps evidence in a restricted folder. If his findings later matter in an audit or dispute, he can show exactly what he saw and when. Evidence handling is a professional discipline, not a technical extra.
3.3 Respecting donor privacy
Donation records include names and contact details. Marcus uses only what he needs: for reconciliation he works with receipt numbers, amounts and transaction references, not donor names. He reminds colleagues that public ledgers show transaction amounts and addresses to anyone, so linking an address to a named donor in shared documents could expose that donor's other activity. He proposes that shared reports use receipt numbers only. Privacy is part of trustworthy practice and is particularly important for charities, whose donors expect discretion.
Worked example
Marcus works under written read-only scope, hashes every export and reconciles with receipt numbers rather than donor names.
Synthetic case. The authorisation, evidence and records are synthetic.
Errors and limits
Linking public addresses to named donors in shared documents can expose donors' other activity.
Exercises
- EX011 — Scope exclusion. Name one activity excluded from scope. Rubric: 3 = moving real funds;; 2 = contacting donors;; 1 = reviewing configuration;; 0 = none.
- EX012 — Urgent contact. What does the authorisation name for urgent findings? Rubric: 3 = who to contact;; 2 = a contact;; 1 = vague;; 0 = none.
- EX013 — Evidence integrity. How are exported files protected? Rubric: 3 = storing a SHA-256 hash of each;; 2 = hashing;; 1 = emailing;; 0 = none.
- EX014 — Reconciliation data. What data does Marcus use for reconciliation? Rubric: 3 = receipt numbers, amounts and references;; 2 = receipts;; 1 = donor names;; 0 = none.
- EX015 — Public ledger risk. Why avoid linking addresses to names? Rubric: 3 = it could expose donors' other activity;; 2 = privacy;; 1 = cost;; 0 = none.
Synthesis
Written authorisation, careful evidence and donor privacy define authorised practice.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →