Can you reconstruct an assessment decision six months later?

Six months after an assessment, a candidate challenges the result. The team can find the published score, but the question has changed since delivery. The rubric in the shared drive has no version number. One marker remembers using an AI suggestion, another believes the response was moderated, and the email approving publication has been deleted.

Every system involved may have an activity log, yet the organisation cannot reconstruct the decision. This is the difference between collecting events and preserving an evidence trail.

Design backward from the future question

Imagine the questions a candidate, regulator, manager or auditor may reasonably ask: What was submitted? Which standard applied? Who evaluated it? What assistance was used? Why did the final result differ from the first score? What changed after publication?

For each question, identify the record needed and the authorised role that should see it. Then connect records through stable identifiers. The candidate attempt should link to the assessment version, items, rubric, responses, evaluation actions, adjustments, incidents, approval and publication. A timestamp alone is not enough if nobody can tell which object it belongs to.

Capture context at the time of action. Reconstructing todays configuration does not prove what the reviewer saw months earlier. Snapshot or version the material that governed the decision.

Version the decision ingredients together

Questions, rubrics, scoring rules, thresholds, policies and model configuration can all change. Give each governed release an identifier and effective date. When one element changes materially, create a new version rather than editing history.

Keep the relationship visible. A response belongs to assessment version 4; its rubric is version 2; an assisted review used a recorded model configuration; publication followed policy version 3. The detail may live in different stores, but the decision view should reconnect it without manual detective work.

Drafts matter too. Record author and approver actions so the organisation can explain how an item reached live use. Do not expose confidential item history broadly, but preserve it for authorised quality and investigation work.

Record human and automated actions distinctly

If automation scores an objective response, records should show the rule and outcome. If AI suggests rubric evidence or feedback, retain the suggestion, source set and configuration separately from the reviewers approved decision. Do not overwrite the suggestion after an edit.

Human actions need meaning, not just clicks. User 183 updated record is technically correct but operationally weak. Record that the marker changed criterion 2 from level 3 to level 2, with a rationale, after reviewing a specified response. Where free text is unnecessary, use structured reason codes with an optional explanation.

Make disagreement easy to express. An override should not be treated as an exception to hide. Patterns of override are valuable quality evidence about the rubric, assistance and reviewer training.

Connect moderation and appeals to the original record

A second review should not create a disconnected result. Preserve the original evaluation, the moderated view, differences, rationale and authority for the final outcome. If a blind re-mark is required by policy, protect independence while maintaining the later link.

Appeals should reference the same evidence trail. Record the grounds, material considered, decision, notification and any correction. If the appeal reveals a wider problem, identify other attempts exposed to the same item, configuration or policy and review them systematically.

When a published result changes, maintain publication history. People and downstream systems need to know which value was current at which time and why it changed. A silent database update may fix the display while destroying accountability.

Include candidate experience and incidents

A decision cannot always be interpreted from responses alone. Connection loss, failed saving, inaccessible interaction, an incorrect adjustment or a proctoring interruption may affect what the candidate could demonstrate. Connect material incidents to the attempt and show how they were resolved.

Issue a submission receipt containing a reference, time and status. This gives the candidate evidence and helps support locate the record. If submission is incomplete, say so accurately and provide a recovery route.

Do not use the audit trail as an excuse for unlimited surveillance. Collect events needed for integrity, support and explanation. Avoid storing every pointer movement, keystroke or unrelated device detail merely because the technology allows it.

Design access by purpose

Candidates may need their response, result, criteria and explanation. Markers need assigned responses and rubrics. Administrators need workflow status. Auditors may need a representative decision path. Engineers need technical diagnostics but not unrestricted candidate content.

Create role-based views from the same governed record. Log sensitive access and review unusual patterns. Mask or separate identity where possible. Make exports controlled and traceable, because an excellent in-platform permission model is undermined if everyone can download a complete spreadsheet.

Retention should follow documented purpose, legal requirements, appeal periods and data minimisation. Different records may have different lifetimes. Delete securely when the period ends, including derived copies where practicable, while preserving lawful holds through an explicit process.

Make correction visible

Audit data can contain errors. A support colleague may attach an incident to the wrong attempt or a marker may choose the wrong reason code. Allow correction, but append it. Record who corrected what, when and why, while preserving the original event for authorised review.

System clocks, user identity and service integrations need attention. Synchronise time, distinguish service accounts from people and record delegated actions. If events arrive from external tools, validate source and avoid accepting untrusted descriptive text as executable instructions.

Test reconstruction as a release requirement

Select representative cases before launch: a normal pass, a moderated response, an AI-assisted evaluation, an accessibility incident, an appeal and a corrected publication. Give an independent reviewer the authorised records and ask them to reconstruct each decision.

Measure completeness, clarity and time. If the reviewer needs database access, private messages or the memory of a product owner, the trail is incomplete. Repeat the exercise after material workflow changes. Monitoring that records exist is useful; proving they answer the real question is better.

A minimum decision record

• candidate and attempt reference with appropriate identity controls;
• assessment, item, rubric, policy and threshold versions;
• submission content, timestamps and receipt;
• approved adjustment and material delivery incidents;
• automated score or suggestion with source and configuration;
• marker evidence, decision, rationale and changes;
• moderation, approval and authority;
• publication state and revision history;
• appeal, correction and notification records;
• access, retention and deletion controls.

Plan for systems that do not share one database

Assessment estates are rarely tidy. Invitations may sit in a learning system, delivery in a specialist platform, identity checks with a supplier and outcomes in HR or student records. Do not solve this by copying every raw record everywhere. Define a canonical reference, event contract and ownership boundary so authorised views can reconnect evidence when needed.

Test integration failure. If publication succeeds but the downstream result transfer fails, which system is authoritative and who is alerted? If a supplier is unavailable during an appeal, what evidence remains under your control? Reconciliation should be a designed process with idempotent updates and visible exceptions, not a spreadsheet exercise performed after someone notices different scores.

Exports need version and provenance too. A CSV created today may be mistaken for the original publication state. Include generation time, scope and stable identifiers, and protect the file according to its sensitivity. Where evidence must remain portable, prefer documented formats over screenshots that lose structure and meaning.

The six-month test

A useful audit trail lets an authorised person answer a reasonable challenge from connected evidence without recreating the past from memory. It shows not only what happened but which version, source and authority gave the event meaning.

Choose a published decision now and try the six-month test. If the path breaks, repair the workflow before the next challenge. The purpose is not to produce more logs. It is to keep decisions explainable, correctable and worthy of the consequence attached to them.