Organisations make ever more claims. Their ability to substantiate them does not grow at the same pace. The auditor examines that gap with a specific question · what is the evidence. When the answer requires improvised reconstruction, the architecture does not yet exist.
This criterion is the root of the corpus. It defines what turns a claim into evidence; the others develop its components · Criterion 03 addresses scope, 06 the actor, 09 validity, and 13 applies the five elements to the State. Anyone who masters this criterion reads any institutional statement with the same instrument.
Three pathologies of claims
Pathology 01 · the promise measured by intention. The organisation declares its commitment · to diversity, sustainability, responsible artificial intelligence. Ask for data and intent appears · the annual report, the section dedicated to the topic. The auditor needs something else · a number, a date, someone responsible, a verifiable operational change.
Sustainability claims illustrate this pathology through public case records. DWS paid 19 million dollars to the SEC for misleading statements about its ESG process (SEC, 2023). A court in Amsterdam examined nineteen environmental claims by KLM and ruled fifteen misleading (Tribunal de Ámsterdam, 2024). ESMA subsequently set thresholds and exclusions so that ESG fund names would be supported by measurable criteria. The label was no longer enough on its own.
Pathology 02 · the promise that measures itself. The organisation has a quality policy. The policy declares a commitment to quality. The indicator is the existence of the policy. The circle closes without touching operations. The PCAOB estimated that approximately 40 % of the audits reviewed in its 2022 inspections had one or more deficiencies included in the public portion of the report (PCAOB, 2023). The figure describes an inspection sample, not the entire profession; it is enough to remind us that the control system also needs evidence of its own performance.
Pathology 03 · the promise that exceeds the third-party statement. The organisation displays a certificate issued within a defined scope and under specified requirements. It then presents it as proof that the entire operation functions continuously. The problem is not necessarily in the document; it arises when the narrative expands what the assessment allows us to conclude.
The five elements of verifiable evidence
A technical statement gains strength when it allows five elements to be reconstructed. The absence of one does not make the others false; it reduces what can be concluded and requires the limitation to be stated.
Element one · actor. The technical decision must be traceable to a person, a function or a collective body with documented authority. Without that traceability, it is impossible to know who could decide and who was accountable. Criterion 06 develops this element.
Element two · date. The decision occurred at a particular time, and the record must allow it to be compared with subsequent events. The stated date does not guarantee authenticity; it needs provenance and integrity. Its absence makes it impossible to distinguish a prior decision from a later reconstruction.
Element three · criterion. The rule applied must be identifiable and documented with enough precision for another professional to review the reasoning. This does not eliminate judgement or require identical results; it allows a difference to be explained.
Element four · scope. The decision applies to a specific subject, period and context. The stated boundaries form part of the argument; leaving them unspoken expands the conclusion without evidence. Criterion 03 develops that boundary.
Element five · validity. The technical decision needs a review horizon or a condition that requires it to be reopened. In systems with continuous deployment, stating validity acknowledges that knowledge ages and allows that ageing to be governed. Criterion 09 turns that temporal boundary into a discipline.
The sixth problem · supporting material
The five elements assume something that can no longer be assumed in this decade · that the record supporting them is genuine. A PDF can be generated in seconds. A log can be fabricated. Minutes can be synthesised with the voice and signature of someone who never set foot in the room. Actor, date, criterion, scope and validity can all be present and all be synthetic.
A first defence is to distinguish evidence produced by operations from evidence prepared to explain those operations. A batch generated shortly before the audit does not prove falsity; it changes the risk and requires corroboration. The integrity and provenance of the record form part of that assessment, developed in Criterion 14.
The criterion test
Before the next committee meeting, identify a specific public statement by the organisation · sustainability, cybersecurity, diversity, responsible AI. Apply the five elements, one by one. Each has an expected answer.
Actor · person, function or body with documented authority. Date · a record whose provenance allows the decision to be placed in relation to the outcome. Criterion · an identifiable rule and reviewable reasoning. Scope · what it covers and what it leaves out. Validity · a review date or a condition that requires the decision to be reopened.
Five answers with evidence that can be consulted form a well-structured statement. If any are missing, the statement must be corrected or the claim expressly limited. Also review the files’ creation dates. An unusual concentration of records attributed to different periods is a signal to investigate, not an automatic conclusion about their authenticity.
The entire doctrine fits into the phrase that gives this criterion its title · claims must be substantiated. The other criteria exist to give that phrase instruments.