Association is the beginning of a question.
A firm name on a project, a shareholder relationship, a signature or a job title can identify a lead. None of these alone establishes who made a particular decision, what duty applied or whether an act caused a loss. Keep the link as narrow as the record permits.
Map the contracting entity, individual role and decision date separately. A company can change its name, team or scope during a project. Verify identity and dates before combining records from different matters. Avoid merging two people because their names resemble each other.
Write a finding in six parts.
| Part | Working entry |
|---|---|
| Observed event | The narrow action, omission or condition recorded, with exact sources. |
| Relevant role | Contracted scope, delegated authority, control and reliance at the time. |
| Information state | What was available then, not only what became clear afterwards. |
| Proposed link | How the event could have contributed to the observed consequence. |
| Alternatives | Credible competing explanations and evidence that could distinguish them. |
| Limit | Uncertainty, missing records, conflicting accounts and the permitted use of the finding. |
Distinguish an observation from a hypothesis, an expert opinion and a legal conclusion. A records review can supply the chronology and missing-link questions. Technical standard-of-care, legal liability and damages questions need the appropriate qualified adviser.
Make competing explanations operational.
Do not append “there may be other causes” to an otherwise fixed narrative. Name the alternatives: changed owner scope, an unforeseen condition, design development, installation, maintenance, coordination, inaccurate quantities or a mixed cause. List what each would predict and which record could distinguish them.
For example, repeated extra work may be a pricing error, a duplicated invoice or two separate phases with similar descriptions. Compare item IDs, quantities, dates, payment allocations and credits before describing a duplicate charge. Evidence that weakens a preferred theory belongs in the brief, not in a discarded folder.
A gap has a search boundary.
Write “not located in the reviewed set” with the custodians, date range, systems and search terms. That is not the same as “never existed.” Record whether a custodian searched, declined, redacted, transferred the request or reported deletion. Those responses have different meanings.
Two sources repeating one source are not two independent confirmations. A project summary quoting an invoice and a news item quoting the summary still depend on the invoice for that amount. Keep source dependence visible in the evidence map.
A fair response can improve the record.
Before material attribution is circulated, plan a proportionate factual check with counsel or the responsible reviewer. Identify the exact statements, supporting locators and unresolved questions. Where appropriate and lawful, invite the relevant party to identify corrections or contrary records. Do not use a request as a threat or offer silence in exchange for money.
A response is evidence to evaluate, not automatic validation or automatic denial. Preserve its date, authority and attachments. Update the finding if it resolves a mismatch. An unanswered message does not establish guilt or agreement.
Separate the working brief from a public account.
Prepare a disclosure gate: intended audience, authority to share, personal information, confidentiality, privilege, accuracy, response status and potential harm from an error. Use a minimum-necessary extract for an adviser rather than forwarding an entire mailbox or personnel file.
Do not assume that adding “alleged” makes any statement safe to publish. Get qualified advice before publishing accusations, making a complaint with legal consequences or contacting a broad group about an identifiable person. This guide is an evidence workflow, not legal advice or a misconduct determination.