Reconstruction is not accusation
Causal reconstruction is the disciplined process of explaining how an outcome occurred from authenticated records, observations, technical analysis, and stated inference. It is different from collecting material that supports a preferred conclusion.
The process begins with a neutral outcome statement: what happened, where, when, and with what measurable consequence. It does not begin with a person’s name or a theory about motive. Those choices reduce confirmation bias and help the review detect system conditions, shared causes, and evidence that weakens the initial hypothesis.
The right first question is not “Who can we blame?” It is “What sequence of conditions and decisions best explains the observed result?”
A reconstruction may inform engineering, operational, contractual, insurance, legal, regulatory, or governance work. It does not replace the qualified experts or formal processes responsible for those conclusions.
Preserve before interpretation changes the scene
Evidence is often most vulnerable immediately after an event. Logs rotate. Devices reconnect. People update documents. Teams repair systems. Messages disappear under normal retention. Well-intentioned troubleshooting can destroy the ability to explain what happened.
Use an authorized preservation plan that is proportionate to the issue:
- record the observed state, time source, location, system, and person making the observation;
- preserve volatile logs, alerts, configuration, access state, and system time information;
- snapshot relevant repositories and issued-document registers without changing originals;
- identify custodians and pause ordinary deletion where authorized and appropriate;
- separate evidence copies from working copies;
- record every collection, transfer, transformation, and access to sensitive evidence;
- respect privilege, privacy, employment, contractual, and regulatory limits.
Build one event chronology
Chronology is the spine of reconstruction, but it must preserve provenance and uncertainty. Normalize time zones without discarding the original timestamp. Record clock drift. Separate the time an event occurred from the time it was logged, transmitted, received, reviewed, approved, or implemented.
| Field | Purpose |
|---|---|
| Time and basis | Original timestamp, normalized timestamp, time source, known drift |
| Event | Neutral description of the observed or recorded action |
| Source | Stable record ID, custodian, system, revision, authenticity status |
| Actor or system | Identity shown by the source, with confidence limits |
| Evidence class | Observed fact, provided record, missing evidence, or inference |
| Responsibility link | Relevant scope, authority, or control, if established |
| Open question | What remains unknown and which evidence could resolve it |
Do not collapse independent sources into a single sentence. If a field log, email, model, and system event disagree, preserve all four positions. The disagreement may be more informative than an artificially tidy sequence.
Reconstruct the information state
For each consequential decision, create a snapshot of what was known, unknown, assumed, requested, and pending. This controls hindsight bias and reveals whether a later-critical fact was actually available to the decision-maker.
Test competing explanations
A leading theory becomes credible when it explains the evidence better than reasonable alternatives. Repetition does not strengthen the record. Write at least two credible explanations and identify the evidence each predicts.
| Hypothesis field | Question |
|---|---|
| Mechanism | By what physical, technical, operational, or managerial path would this cause produce the outcome? |
| Expected evidence | What records or observations should exist if the explanation is correct? |
| Contradicting evidence | Which established facts are difficult for the explanation to account for? |
| Missing discriminator | What obtainable evidence would distinguish this explanation from the alternatives? |
| Confidence | How strong is the explanation, and what could materially change that assessment? |
Examples of competing causes include original design, changed requirements, incorrect input data, field condition, installation method, inadequate coordination, owner direction, unauthorized modification, maintenance state, operator action, supplier defect, or several causes interacting.
Test the causal chain
A temporal sequence, where A happened before B, does not automatically prove that A caused B. A defensible causal analysis examines mechanism, necessity, sufficiency, contribution, foreseeability where relevant, and intervening conditions.
- Mechanism. Describe how the proposed cause could produce the observed outcome.
- Temporal order. Confirm the cause existed before the effect and that the timing is compatible with the mechanism.
- Counterfactual. Ask what likely would have happened if the proposed act, omission, or condition were different.
- Alternative causes. Test independent, shared, and intervening explanations.
- Evidence strength. Weigh authenticated primary records more heavily than later recollection or unsupported summary.
- Responsibility link. Only after the mechanism is supported, ask which role had the relevant duty and control.
Counterfactual reasoning must remain grounded. “If the email had been read, the issue would have been prevented” contains several assumptions: that the recipient had authority, understood the significance, could act in time, and that the proposed action would have changed the outcome. Each link needs evidence.
Complex projects often have necessary but insufficient causes. A technical error may be necessary for the event, while weak change control, incomplete review, and field deviation determine whether the error reaches the final outcome. Report that system rather than compressing it into one name.
One item can appear in five records. Count it once.
Money reconstruction starts with matching identities, not adding every number in a folder. A budget, commitment, invoice, payment and repair cost describe different states. Some describe the same economic item. Keep them in separate columns until their relationship is established.
The following is a fictional records exercise. All amounts are Canadian dollars on the same tax basis. It is not a valuation of a real loss, a finding about a real party or advice on what can be recovered.
| Record ID | Amount and state | Relationship to the item |
|---|---|---|
| APP-02 | 15,000 approved change value | A commitment for CH-02, subject to the exact scope and conditions recorded |
| INV-07 | 15,000 invoiced | The billing record for the same CH-02 work, not another 15,000 of work |
| PAY-04 | 10,000 paid against INV-07 | Settlement of part of that invoice, not an additional cost to add to it |
| REP-01 / PAY-06 | 3,000 repair invoiced and paid | A separate repair transaction that still needs a causal and scope link |
| CR-01 / RCPT-01 | 1,000 repair credit received | An offset against the repair, not a new payment for CH-02 |
Adding 15,000 + 15,000 + 10,000 + 3,000 gives 43,000, but mixes a commitment, a bill, a partial settlement and a separate repair. The matched change records instead describe a 15,000 invoiced item with 10,000 paid. In this simplified exercise, 5,000 remains unsettled at the chosen cut-off date. Separately, the recorded repair outflow after the received credit is 2,000.
Even that 2,000 is not automatically attributable or recoverable loss. The reviewer still needs to distinguish repair from added scope or improvement, establish the cause, check other offsets and identify the responsible decision. Qualified advisers must assess any disputed accounting, contractual or recovery conclusion.
Build the crosswalk around an item, not a filename.
Give each economic item a stable item ID. Map all supporting documents to it, while keeping the source IDs distinct. An invoice can contain several items; a payment can settle several invoices; a change can be split over several bills. Preserve those allocations instead of forcing a one-document-to-one-item rule.
- Scope identity: contract, work package, change identifier and description of the exact work.
- Amount basis: currency, tax treatment, units and whether the figure is gross or net.
- State: estimated, committed, invoiced, certified, disputed, paid, credited or still unallocated.
- Timing: record date, work period, payment date and the common reporting cut-off.
- Relationships: invoice lines, payment allocations, replacement invoices, credits, refunds and retained amounts.
- Source and gap: exact supporting record, reconciliation status and the missing item needed to close the match.
Five traps to check before using the total
- Commitment plus settlement. Do not add an approved amount, its invoice and its payment as though each is separate expenditure.
- Cumulative versus period figures. A cumulative certificate may include earlier certified work. Compare the change between periods before adding certificates.
- Replacement versus additional invoices. A corrected invoice may supersede the original. Match references and confirm status rather than counting both.
- Credits and offsets. Distinguish a credit proposed, issued, allocated and actually received. Show unsettled offsets separately from received cash.
- Unlike bases. Tax-inclusive and tax-exclusive figures, different currencies, retained balances and different cut-off dates cannot be compared without a stated reconciliation.
A clean crosswalk should produce two different outputs: the reconciled states of the money and the unresolved explanation for any additional cost. Neither output should be silently converted into a misconduct finding.
Report what is known, inferred, and unresolved
A reconstruction is strongest when the reader can see the boundary of the conclusion. Use a consistent structure:
- Observed outcome: neutral description and measurable consequence.
- Scope and authority: systems, records, dates, questions, exclusions, and collection authority.
- Chronology: sourced event sequence with conflicts preserved.
- Established facts: conclusions directly supported by authenticated evidence.
- Supported inferences: reasoned conclusions with their evidentiary basis and confidence.
- Missing evidence: expected but unavailable sources and the search performed.
- Alternative explanations: how each was tested and why it remains plausible or weakened.
- Responsibility boundaries: relevant duty, authority, reliance, and control without exceeding the evidence.
- Actions: preservation, immediate controls, verification, and decisions still required.
Avoid absolute wording where the evidence supports probability or contribution. Avoid motive conclusions unless motive is genuinely relevant and supported. Avoid publishing names or allegations merely because they appear in internal working material.