Reporting. How to document the results of an investigation

What a report consists of

• Statements. Each statement stands on its own and carries its source: a document, a registry, a page, the date of access. A statement without a source does not enter the report: it either receives a source or moves to the section of gaps.
• Relations. Relations between records are named, and every relation carries its basis. The relation "owns" requires a document of ownership. The relation "presumably connected" keeps that name and is drawn differently from a confirmed one.
• Gaps. Everything not established is listed by name: which question is open, what was searched for, where, and with what result. An open gap is a fact about the work, not a defect of it.
• State of verification. For every record it is visible how far it went: the source is named, a document is attached, a verification task is closed, a second person has confirmed. These are four marks, without a percentage.
• Documents. Attached in full and with a checksum. A lawyer needs the document itself, and a retelling is not enough.
• Chronology. Dated events appear in the order they happened, with the source of each date. The date of a document and the date of an event are different things, and the report does not mix them.

What a report does not contain

• Estimates without a calculation. Percentages of "reliability", ratings and indexes with no formula behind them. If a number cannot be computed from the data and explained, it is absent.
• Conclusions without a chain. A conclusion that cannot be reached from a source along named relations moves to the gaps. If the chain does not hold, the report says so plainly.
• Data about private life. Location in real time, correspondence, the profile of a private individual. The boundary of use is written down and does not change on request.
• Decoration in place of content. A diagram exists to show the shape of the chain. Red on a diagram means only risk.

Order of assembly

1. The source is recorded before the fact. The link, the document and the date of access are fixed at the moment of the finding. They are not reconstructed from memory before delivery.
2. The fact becomes a record. A record has a type (a person in a public capacity, an organisation, a location, a document), a name and a source. One fact, one record, without duplicates under different names.
3. The relation receives a basis. A relation between records is created only with a document, or it is marked as a presumption.
4. The gap becomes a task. Every open question becomes a verification task with an assignee and a result. A closed task returns its result to the record.
5. A second person confirms. The signature of a second analyst means one thing: they saw the record in this form. It does not mean the record is true.
6. The report is exported. The material leaves as one file: records, relations, documents, the state of verification. An outside newsroom opens it with its own software and sees what it rests on, without installing the product.

Form

A report exists in two forms, and both are assembled from the same records. A file is for verification with other people's software. A document is for reading, with footnotes to the records, a section "What the material rests on" and a section "What is not established".

The document contains nothing that is not in the file: it is the same material in a form for reading.

Why

A report is read a year later by a person who did not write it and by a lawyer who took no part in the investigation. Both ask one question: how is this known.

A report built as a chain answers that question at every statement. A diagram without sources gives no way to answer it.