Anatomy of a finding
It was always there.It only looked like the sea floor.
Concealment in records is rarely deliberate. Irregularities take the colour of whatever surrounds them, which is why they survive reconciliation, audit and review untouched for years.
Lifecycle
From detected to approved.
Detected
A candidate contradiction surfaces from the combined record. It is a question, not a conclusion.
Triage
An analyst assesses whether the candidate is coherent enough to justify examination.
Investigating
Alternative explanations are tested against the records. Most candidates end here.
Corroborated
The contradiction holds across independent sources, not one system's account of itself.
Quantified
Deterministic calculation with stated inputs, version and population, plus a duplicate check.
Substantiated
A named analyst can trace the conclusion to source records and stands behind it.
Approved or closed
Independent review either approves the finding for report or closes it with reasons recorded.
Camouflage is not deception.
It is a defect that matches its background.
Move the light and it stops working.
Classification
What a badge on a finding means.
Substantiated - documentary
The records themselves establish the fact. The strongest class.
Substantiated - contractual
The agreement in force at the date of the event establishes entitlement.
Substantiated - pattern
Sustained and concentrated across the period, not a single event.
Substantiated - reconciliation
Two authoritative accounts of the same events cannot both be true.
Substantiated - qualified
Supported, with a stated limitation that changes remedy or scope.
Closed - explained
An alternative explanation held. Recorded, with reasons, and not reported as a finding.
An examination that substantiates everything it detects has not investigated. Discarding candidates is a normal and expected outcome, and closed candidates are recorded rather than deleted.