Questions worth exploring
Make the reasoning part of the record.
Before discussing a report format, identify the reader and the question the record should answer. Consider the context needed to follow a finding and the information needed to revisit a decision. Reports & Audit Trails pairs each finding with its evidence and a tamper-evident activity history, exportable to PDF or CSV.
- Evidence1
Collect relevant evidence
Link screenings, alerts, graphs and documents.
- Evidence2
Separate evidence from interpretation
Label what was observed apart from what was concluded.
- Interpretation3
Record findings
State each finding and cite the evidence behind it.
- Interpretation4
Add reasoning and limitations
Explain the reasoning and say what is not known.
- Decision5
Request reviewer approval
A named reviewer approves, comments or asks for changes.
- Record6
Generate the report
Produce a versioned report for the intended reader.
- Record7
Preserve the activity history
Keep a timestamped record of who changed what.
- Source evidenceWhat was observed or received, as it came from its source.
- Analyst interpretationWhat a person concluded from the evidence, and why.
- Final decisionWhat was decided, by whom and when.
Illustrative reporting workflow. Your stages and approval steps are agreed during evaluation.
- Keep in view · 01
The intended reader
Describe whether the record is for an analyst, an internal reviewer, or another authorized recipient. Set out the background each reader needs.
- Keep in view · 02
Evidence and reasoning
Identify the source references, observations, notes, and limitations you would want to present together. Ask how any available output separates evidence from a conclusion.
- Keep in view · 03
History and delivery
Discuss what changes should be understandable over time and how a record would leave the working environment. Ask about available history, format, and access options.
Report builder demonstration
Write the report next to the evidence it rests on.
A report is written section by section, with each statement tied to numbered evidence, reviewer suggestions shown in place and the status of every section visible.
Executive Summary
Source evidenceThis report reviews funds that moved from a screened wallet through one intermediary address within 36 hours . The intermediary serves many customers, so its ownership is not established . The case was escalated for a senior view .
Lead with the escalation, then the limits.
Scope
Source evidenceCovers activity on one network between Oct 18 and Oct 24, 2024, linked to CASE-2041. It does not cover activity outside the linked case or any legal determination of ownership.
Scope set with the case owner.
Findings
Analyst interpretation- F1 Funds moved through one intermediary within 36 hours
- F2
The intermediary belongs to the flagged entityThe intermediary is a service address used by many customers; ownership is not established - F3 One indirect sanctions path at two hops; no direct exposure found
F2 overstated the evidence. Suggested wording shown above.
Evidence
Source evidence| Ref | Item | Nature |
|---|---|---|
| [1] | Wallet screening report | Source evidence |
| [2] | Transaction alert | Source evidence |
| [6] | Analyst note | Analyst interpretation |
| [8] | Case decision | Final decision |
Eight references linked. Source documents added.
Analysis
Analyst interpretationThe transfer pattern is consistent with layering, but the same pattern also appears in ordinary service activity . Without the counterparty statement the reviewer cannot rule out an internal transfer.
Add what would change this conclusion.
Limitations
Analyst interpretationAttribution of the intermediary is a reference, not a statement of legal ownership. Sanctions results reflect the sources available at the time of screening. To be completed by the analyst.
State the limits of the attribution clearly.
Decision
Final decisionDecision recorded by a person: escalated to the compliance lead . Rationale and approval are added once the counterparty statement is reviewed.
Approval waits for the statement.
Audit History
Generated from the activity record. This section is not edited by hand. It lists each creation, change, comment, decision and export with a name and a time.
Included in the exported report.
Illustrative demo data with a fictional report. Nothing here is stored or sent.
Report preview
A document a reader can follow and trust.
The finished report opens with who prepared and reviewed it, then states the findings, the evidence behind them, the method, the limits and the decision. It is designed to be read by an internal reviewer or, once your team has approved it, shared outside.
Layered transfers from a flagged wallet (example)
RPT-2041-03- Prepared by
- Analyst
- Reviewed by
- Compliance lead
- Date
- Oct 24, 2024
- Version
- 3
Summary of findings
- Funds moved through one intermediary within 36 hours. [1][2][3]
- Intermediary ownership is not established. [4][6]
- One indirect sanctions path at two hops; no direct exposure found. [5]
Methodology
Findings are drawn from linked screenings, alerts and an investigation graph. Statements of interpretation are labelled and reviewed by a second person.
Limitations
- Attribution is a reference, not legal ownership.
- Sanctions results reflect sources at the time of screening.
Evidence register
| Ref | Evidence | Nature | Time |
|---|---|---|---|
| [1] | Wallet screening report | Source evidence | Oct 21 |
| [2] | Transaction alert | Source evidence | Oct 21 |
| [3] | Investigation graph | Source evidence | Oct 24 |
| [6] | Analyst note | Analyst interpretation | Oct 24 |
Transaction path
Decision record
Recorded by a person on Oct 24, 2024. Final approval pending the counterparty statement.
- Recorded by
- Senior reviewer
- Approval
- Compliance lead, pending
Illustrative document with fictional content. Templates and layout are agreed during evaluation.
Evidence traceability
Every finding points back to its source.
Each finding carries numbered citations. Select one to see which screening, alert, graph, entity reference, sanctions result, note, document or decision it comes from.
- F1
Funds moved through one intermediary within 36 hours.
- F2
The intermediary is a service address used by many customers; ownership is not established.
- F3
One indirect sanctions path at two hops; no direct exposure found.
- F4
A counterparty statement was received and attached.
- D
The case was escalated to the compliance lead.
[1] Wallet screening
- Item
- Screening report, 0x3be0..5d17
- Time
- Oct 21 · 10:12
- Nature
- Source evidence
A screening result for the wallet, with its status and time.
Select a citation on the left or an item below to see where a statement comes from.Illustrative demo data with a fictional report.
Audit timeline
Who did what, when, and what changed.
Every meaningful action is recorded with a role, a time, the previous value, the new value and the evidence it relates to, so a later reviewer can follow how the report reached its current state.
Report created
AnalystCreated
Previous value—New valueDraft, version 1Related evidenceNoneEvidence added
AnalystAdded
Previous value0 itemsNew value3 itemsRelated evidenceFinding updated
Senior reviewerEdited
Previous value“The intermediary belongs to the flagged entity”New value“The intermediary is a service address; ownership is not established”Related evidenceReviewer assigned
AnalystAssigned
Previous valueNo reviewerNew valueCompliance leadRelated evidenceNoneComment added
Compliance leadCommented
Previous value—New value“State the limits of the attribution.”Related evidenceDecision changed
Senior reviewerChanged
Previous valuePendingNew valueEscalatedRelated evidenceVersion generated
Recorded by the systemGenerated
Previous valueVersion 2, draftNew valueVersion 3, in reviewRelated evidenceExport completed
AnalystExported
Previous valueNot exportedNew valueExported copy of version 3Related evidenceNone
To confirm. This timeline shows the kind of record an audit trail keeps. Whether a history is tamper-evident, and exactly how, is confirmed during evaluation. The FAQ on this page describes tamper-evident hashing, and you should ask how that fits your own audit requirements. No immutability guarantee is made here.
Illustrative demo data with a fictional report.
Version comparison
See exactly what changed between two versions.
When a report is revised, a reader can compare two versions and see what was added, removed or changed, which evidence is new, what the reviewer said and whether the decision moved.
- +2added
- −1removed
- 3changed
- 2new evidence
- 2reviewer comments
- 1decision change
- +AddedFindingsF3: One indirect sanctions path at two hops; no direct exposure found.
- ~Changed findingFindings
The intermediary belongs to the flagged entity.The intermediary is a service address used by many customers; ownership is not established.Reviewer suggestion accepted - −RemovedAnalysis
The pattern proves layering.Reviewer comment: overstated - +New evidenceEvidence[5] Sanctions result and [7] Counterparty statement
- ~Reviewer commentsLimitations
0 comments2 comments, 1 resolved - ~Decision changeDecision
PendingEscalated to the compliance leadRecorded by a person
Illustrative demo data. How versions are stored and compared is confirmed during evaluation.
Reporting for different readers
One body of evidence, written for the reader.
Different readers need different amounts of detail, but they should all be able to trace a statement to the same evidence. These five audiences are illustrations. Exact templates and customization are items to confirm during evaluation.
Internal analyst
Works the case and needs the full working detail.
Every finding, every evidence table, the analyst notes and the working comments.
- SummaryFull
- ScopeFull
- FindingsFull
- EvidenceFull
- AnalysisFull
- LimitationsFull
- DecisionFull
- Audit historyFull
Compliance manager
Reviews findings and approves the decision.
Findings with their citations, the evidence summary, the limits and the decision record.
- SummaryFull
- ScopeSummary
- FindingsFull
- EvidenceSummary
- AnalysisSummary
- LimitationsFull
- DecisionFull
- Audit historySummary
Executive reviewer
Needs the outcome and the risks, quickly.
A one-page summary, the decision and the key limitations.
- SummaryFull
- ScopeNot included
- FindingsSummary
- EvidenceNot included
- AnalysisNot included
- LimitationsFull
- DecisionFull
- Audit historyNot included
Auditor
Checks how the conclusion was reached.
The evidence register, version history, decision record and full audit history.
- SummarySummary
- ScopeFull
- FindingsSummary
- EvidenceFull
- AnalysisSummary
- LimitationsSummary
- DecisionFull
- Audit historyFull
External stakeholder
Receives what your team decides to share.
An approved extract. What is shared, and what is left out, is decided by your team.
- SummaryFull
- ScopeFull
- FindingsSummary
- EvidenceNot included
- AnalysisNot included
- LimitationsFull
- DecisionFull
- Audit historyNot included
To confirm. Which templates exist, how sections can be included or left out, and what can be shared with an external reader are confirmed during evaluation.
Illustrative audiences and sections.
Prepare a focused conversation
Bring a scenario. Define what you want to learn.
Bring an outline of a report your team wants to evaluate, using fictional or approved sample content. We’ll walk through the fields, history view, and export options for your scenario.
- 1Identify the reader
- 2Define the evidence context
- 3Discuss history and delivery
A simple way to structure your evaluation call.
Identify the intended reader
Choose the report purpose
Define required evidence
Select findings and context
Specify approval steps
Define version history
Choose delivery or export requirements
Product verification
What needs confirmation
Reports & Audit Trails generates exportable records that pair findings with the underlying evidence and a timestamped activity history, so a decision can be reviewed later by another analyst or auditor. Use these questions to confirm the details that matter for your evaluation.
- Ask · 01
Available report templates
Which templates exist, and for which readers?
- Ask · 02
Included evidence types
Which kinds of evidence can a report include?
- Ask · 03
Custom report sections
Can sections be added, removed or reordered?
- Ask · 04
PDF, CSV or other export formats
Which formats are available, and what do they contain?
- Ask · 05
Version history
How are versions kept and compared?
- Ask · 06
Reviewer approvals
How are approvals requested and recorded?
- Ask · 07
Audit-event coverage
Which events are recorded, and in how much detail?
- Ask · 08
Record retention
How long are records kept, and can it be configured?
- Ask · 09
Role-based access
Who can view, edit, approve and export?
- Ask · 10
Case and investigation integration
How do reports connect to cases and investigations?
These are evaluation questions, not guaranteed functionality. Answers depend on your deployment and are agreed with the team during your evaluation.
Before your demo
Reports & Audit Trails: questions and answers
Are PDF or CSV exports supported?
Yes. Reports export to PDF and CSV, with the underlying evidence and activity history included alongside each finding. Ask for the current field list for your use case.
Are the records immutable or audit-ready?
Report records use tamper-evident hashing so changes to the underlying activity can be identified. Ask the team how that fits your specific audit or regulatory requirements.
Can reports include investigation or case information?
Yes. Reports can embed evidence and findings from an investigation or case record, so a reader can trace a conclusion back to its source.
Start a conversation
Discuss your reporting requirements
Tell us who reads the record, what it must show and how it should be kept.