Resource
How to build an evidence trail that survives audits and leadership changes
Evidence types, data governance basics, and simple controls you can implement in a week.
An evidence trail is the chain of documentation that links your impact claims to the data that supports them. When it's done well, an evidence trail survives audits, leadership changes, and staff turnover. When it's done poorly, impact claims become unverifiable and lose credibility. Building a robust evidence trail is a governance issue, not just a measurement issue.
What an evidence trail is
An evidence trail connects three things:
- Impact claims: What you say happened (e.g., "80% of participants improved their mental wellbeing")
- Supporting data: The measurements that support the claim (e.g., PHQ-9 scores before and after)
- Source documentation: Where the data came from and how it was collected (e.g., survey responses, consent forms, data collection protocols)
A complete evidence trail allows someone who wasn't involved in the work to verify your claims. They can follow the trail from claim to data to source, checking each link. If any link is broken, the trail fails and the claim becomes unverifiable.
Evidence types: quantitative, qualitative, narrative, third party
Different types of evidence require different documentation approaches:
Quantitative evidence
Numbers, counts, scores, percentages. Requires:
- Raw data files (spreadsheets, databases)
- Data collection protocols (how, when, who)
- Calculation methods (how numbers were derived)
- Sample sizes and response rates
Qualitative evidence
Stories, quotes, observations, themes. Requires:
- Original transcripts or recordings
- Analysis methods (how themes were identified)
- Context documentation (when, where, who)
- Consent for use of quotes or stories
Narrative evidence
Case studies, testimonials, descriptions. Requires:
- Source attribution (who provided the narrative)
- Consent for publication
- Context about selection (why this case was chosen)
- Verification that narratives are representative
Third-party evidence
External evaluations, partner reports, government data. Requires:
- Source documentation (where the evidence came from)
- Permission to use (if required)
- Context about relevance (why this evidence supports your claim)
- Date and version information
The key is documenting not just the evidence itself, but how it was collected, analysed, and used to support claims. This documentation is what survives audits and leadership changes.
Data governance basics for small teams
Data governance doesn't require large teams or complex systems. For small organisations, it means having clear answers to five questions:
- Where is the data stored? Use consistent locations (e.g., a shared drive, cloud storage) and document where different types of data live. Don't rely on individual staff members' computers.
- Who has access? Document who can view, edit, and delete data. Use access controls where possible, but at minimum, document access in a simple register.
- How is data backed up? Ensure data is backed up regularly. For small teams, automated cloud backups are usually sufficient.
- How long is data kept? Have a retention policy that balances legal requirements, privacy obligations, and evidence needs. Document this policy and follow it.
- How is data quality maintained? Have simple checks: data entry validation, regular reviews, error correction processes. Document these processes.
These basics don't require sophisticated systems. They require discipline and documentation. A simple data governance document (one or two pages) that answers these questions is sufficient for most small organisations.
Common risks: broken links, missing consent, undocumented assumptions
Evidence trails fail in predictable ways. Being aware of these risks helps you prevent them:
Risk 1: Broken links
Claims reference data that can't be found, or data files are moved or deleted without updating references.
Prevention: Use consistent file naming, document file locations, and avoid moving files without updating references. Use version control or date stamps.
Risk 2: Missing consent
Using data, quotes, or stories without proper consent, or consent forms that can't be found.
Prevention: Have standard consent forms, store them with the data they relate to, and document what consent covers (data collection, publication, etc.).
Risk 3: Undocumented assumptions
Making calculations or interpretations based on assumptions that aren't documented, making results unverifiable.
Prevention: Document all assumptions explicitly. If you assume a response rate, document it. If you make adjustments, document why and how.
Risk 4: Staff turnover
Key staff leave and take knowledge about data location, collection methods, or analysis approaches with them.
Prevention: Document processes, not just results. Create simple guides for data collection and analysis that survive staff changes.
Simple controls you can implement in a week
You don't need to rebuild your entire system. These simple controls can be implemented quickly and will significantly improve your evidence trail:
Control 1: Evidence register
A simple spreadsheet that lists each impact claim, the data that supports it, and where that data is stored. Update it as you make claims. This creates a map of your evidence trail.
Control 2: File naming convention
Use consistent file names: "ProjectName_DataType_YYYY-MM-DD.ext". This makes files easy to find and prevents broken links.
Control 3: Data collection templates
Create standard templates for surveys, interviews, and observations. Include fields for date, location, consent, and context. This ensures consistent documentation.
Control 4: Assumptions log
A simple document that lists all assumptions made in analysis or reporting. Update it as you make new assumptions. This prevents undocumented assumptions from undermining your evidence trail.
Control 5: Regular evidence audits
Every quarter, pick one impact claim and trace its evidence trail. Can you find all the links? Are they still valid? This practice helps you catch problems before they become critical.
These controls don't require new systems or significant resources. They require discipline and about one day of initial setup. Once in place, they become routine and significantly strengthen your evidence trail.
Building evidence trails that last
A robust evidence trail is a governance asset. It protects your organisation's credibility, supports defensible decision-making, and survives the inevitable changes that occur in any organisation. The key is starting simple and building discipline over time.
CIIS helps you build evidence trails by providing structured data storage, clear links between claims and data, and documentation of assumptions. The system maintains these links even as data is updated or reports are regenerated, ensuring that your evidence trail remains intact over time.