Part III · Chapter 5 · Evidence · lesson 7

Dated by whom, and could you have changed it?

12 min

Builds on A screenshot is a claim about one moment, taken by an interested party

Four artefacts in a folder, each carrying the twelfth of May.

A spreadsheet whose first cell reads Access review — 12 May. A file whose creation date is the twelfth of May. An export from an identity system with the query date rendered inside it. A ticket whose history shows the state changing on the twelfth of May at 14:06, with the name of the account that changed it.

All four say the same thing. Only one of them says it in a way that does not depend on the person who handed it over.

Predict

Which of the four is the weakest claim about the twelfth of May?

The date typed into the first cell of the spreadsheetThe file creation date, since file metadata can be changedThe export with the query date rendered inside the outputThe ticket history, with a timestamp and an account name

Evidence you can edit is evidence about your intentions.

Three tiers, and the question that separates them is who put the date on it.

A date you typed. It asserts a date. It carries no independent trace of one.

A date a system assigned and somebody in your organisation can change. File metadata, an editable document property, a record in a tool where administrators can rewrite history.

A date a system assigned that nobody in your organisation can reach. A commit, an audit log with append-only retention, an email in transit, a record held by a third party.

The question is never whether anybody suspects you. It is what the artefact can still establish once somebody has a reason to ask — and a typed date cannot establish anything in either direction, including that you were honest.

The asymmetry worth noticing

Almost nobody in this field is defending against an accusation of fraud. The overwhelming majority of evidence problems are a person who did the work and recorded it loosely.

So the argument for durable dates is not about suspicion. It is that a date you control carries no information about the period, and establishing something about the period is the entire job. A typed date tells a reader what you believe. The reader already knew what you believed — they asked for evidence precisely because belief is not the thing in question.

There is a second, quieter asymmetry. The strength of your weakest artefact sets the ceiling on how fast the conversation goes, because once a reader encounters one document whose date rests on your word, they have learned something about how the folder was assembled and they read the rest of it differently. One loose artefact does not make the others false. It does change how much work the reader does.

Something people say

“Nobody is going to accuse us of making it up, so the dates do not matter.”

Why it spreads: Because it is nearly always correct about the accusation. People run these controls, record them imperfectly, and are never once suspected of anything. Treating every artefact as a forensic exhibit is genuinely wasteful, and anybody who has watched a team spend a week on evidence hygiene for a control that runs fine has a real grievance behind this sentence.
The part that is true: Entirely true that fraud is not the live risk, and acting as though it were produces expensive theatre. The strong form of this belief is also right about priorities: a control that does not run is a much larger problem than a control that runs and is recorded in a spreadsheet.

The date is not there to defend you against a charge. It is there because the claim you are making is about a period, and a date you assigned yourself is not information about the period — it is information about what you meant to assert.

The second thing the belief misses is what happens if a doubt does arrive, from any direction and for any reason. A durable date resolves it in a minute. An editable one cannot resolve it at all, in either direction, which means an honest organisation holding editable evidence has no way to demonstrate that it is the honest one. That is the actual cost, and it falls on the people who did nothing wrong.

What to do about the artefacts you already have

Upgrading everything is not the move. Most of it costs more than it returns.

Three cheaper habits, in order of how much they buy.

Let the system write the date. Where a tool can produce the artefact itself — an export, a report, a ticket transition — take that version rather than a document about it. This is usually less work than what people are currently doing.

Record where it came from. An artefact with the system, the query and the account that produced it attached is a much stronger object than the same file alone, and the note costs a line.

Say which tier each one is in. A bundle where the loose artefacts are labelled as loose is read completely differently from one where the reader discovers it. Naming your weakest evidence yourself is the single cheapest thing in this track.

Check

A review happens in a meeting and the output is typed-up notes.

Have everyone present sign the notes afterwards to date themHold the review in a tool that records when and by whomEmail the notes to the attendees immediately after the meetingKeep the notes and accept that this control is loosely evidenced

Worth remembering

The question about a date is who assigned it and how hard it would be to assign a different one.
Three tiers: a date you typed, a date a system assigned that your organisation can change, and a date assigned by a system nobody of yours can reach.
The argument for durable dates is not about suspicion — a date you control carries no information about the period, which is the thing being established.
An honest organisation holding editable evidence has no way to demonstrate it is the honest one, and that cost falls on people who did nothing wrong.
Taking the system's own export instead of a document about it is usually less work than what people are already doing.
Labelling your own weakest artefact is the cheapest improvement available, because a reader who discovers it reads everything else differently.