What to Do When Records Contradict Staff Explanations

Separate the Statement From the Record

Capture the interview statement accurately enough to preserve its meaning, including the conditions the employee described. Identify the exact record, its origin, version, date and the event it purports to document. “The operator said every inspection is prior to release” and “this log was entered later” may represent a real inconsistency, or two different time concepts.

Audit question

Do not classify a conflict merely because a word differs. Establish the applicable rule, the event sequence and who is authorized to act. The audit concern is whether a relevant process criterion was met, not whether the employee used the auditor’s preferred language.

Keep the interview record and the transaction record in separate evidence entries. If a staff member refers to “before release,” clarify whether they mean before physical dispatch, before an electronic status change or before the customer was informed. A shared word can conceal different events. Establish common definitions before framing the accounts as mutually exclusive.

Check Record Provenance and System Behavior

For an electronic record, determine whether the displayed timestamp is event creation, synchronization, approval or last modification. Review permissions, integration queues and retention behavior where access is authorized. A screenshot supplied in a presentation may not contain the metadata needed to reconstruct a decision.

Evidence to request

For paper records, inspect contemporaneous originals or controlled copies when available and understand transcription arrangements. Avoid describing a late entry as falsification without evidence; retrospective entry may be authorized, prohibited or governed by a separate control.

The safest digital comparison uses source of record access with sufficient authorization, rather than a screenshot pasted into an email. Where permission to inspect audit logs is limited, record what could and could not be checked. Administrative access may be necessary for some verification but also introduces confidentiality and security considerations; the audit team should not request excessive privileges.

• Check event time, entry time, version and access permissions.
• Seek another independent trace or observed case.

Build a Neutral Chronology

Arrange the event, decision, execution and documentation in chronological order. Mark known facts separately from assumptions. Ask each relevant participant to describe what they directly observed rather than asking them to validate an interpretation chosen by someone else.

Practical decision

If dates and sources remain incompatible, note what would resolve them: A machine log, dispatch scan, independent witness or control system entry. Decide whether that evidence can be obtained ethically, safely and within the audit scope.

A timeline is often the most economical reconciliation tool. List each source and the time type it represents. A quality inspector’s notebook can record physical performance, a cloud form can record synchronization and a dispatch system can show release. These times may all differ legitimately. Look for the point at which the required control decision should have been made.

Test Plausible Alternative Explanations

Consider differences between normal and exception routes, shift practices, local versus central systems, offline operations and time zone settings. The objective is to challenge both the staff account and the record as potential incomplete representations. Seek disconfirming evidence deliberately.

Verification angle

Do not use leading questions such as “Who backdated this form?” before establishing that backdating occurred. A neutral alternative is “Please walk me through when the work was completed and how the timestamp was generated.” The latter leaves space for an accurate explanation.

Preserve alternative hypotheses until they are tested. The auditor may suspect that staff completed forms retrospectively to cover missed work, but that is only one possibility. A network delay, approved handwritten fallback or local system time issue may explain the mismatch. An accusation based on a single ambiguous date can damage trust and obscure a real configuration weakness.

Assess Impact and Extent

Once the discrepancy is understood, examine whether it changed a relevant approval, acceptance, safety or compliance decision. A harmless formatting difference is not the same as a material break in a safeguard. Extend the sample where there is reason to suspect recurrence across users, shifts or systems.

Interpretation boundary

Report findings at the level that the evidence supports. One established breach of a clear requirement can warrant a nonconformity; a wider systemic conclusion requires sufficient evidence of the broader process condition. Avoid speculation about motive or character.

Assess whether the discrepancy actually affects conformity. A date format problem that does not change any recorded event may be an information quality issue; a release without required approval is a different kind of breach. The same record problem can coexist with effective underlying work, so write both observations separately if both are supported.

• Record each statement and source without editorial interpretation.
• Check event time, entry time, version and access permissions.

Close the Evidence Gap Transparently

Share the reconstructed facts with the process owner and invite correction of any technical misunderstandings. Keep an audit trail of the source documents and how the conclusion was reached. Where evidence cannot be resolved, state the limitation and evaluate whether the audit objective remains achievable.

Reporting discipline

Confidentiality and respectful interviewing matter. A records discrepancy is not automatically a disciplinary case. Follow relevant organizational reporting channels if independent evidence reveals a possible integrity concern beyond routine audit competence.

When evidence remains irreconcilable, report the unresolved assurance gap with enough detail for another reviewer to continue. State what records were reviewed, which explanations were considered and why available sources were inconclusive. Do not force a finding category to conceal uncertainty. Management may decide that additional investigation is warranted beyond the original internal audit.

Illustrative Scenario: Late Electronic Entry

Illustrative scenario: A technician says equipment was inspected before restart, while the digital form shows an entry two hours later. A device log trace confirms the inspection time but reveals that synchronization was delayed during network outage. The late timestamp does not establish a late inspection.

Scenario analysis

A second review shows some forms were modified after synchronization without a recorded reason. That is a separate control question: Whether change tracking meets organizational requirements. The final audit report should distinguish the explained timing conflict from any genuinely unsupported modification.

In this scenario, system synchronization explains the late entry but does not automatically justify unlimited historical editing. A useful follow up traces change permissions and audit trail retention against the organization’s own digital record requirements. The report should distinguish the explained fact, the independent secondary risk and any confirmed breach.

Closing Perspective

Disagreement between records and people is resolved through provenance, chronology and alternative explanations, not assumptions about motive.

For the next audit cycle, make the selected control, evidence boundary, decision owner and follow up trigger visible in the working papers. An audit programme earns trust by making its reasoning reviewable and by allowing verified contrary evidence to change the conclusion.