EXAMINATION PROCEDURE

From the question to a bounded finding.

This page explains the operational sequence used to apply the evidence chain. It does not imply that every possible system property was examined.

ODA3 / EVIDENCE SYSTEM↗

EXAMINATION RECORD

QUESTION → SCOPEDefine what can be tested

EVIDENCE → CHECKRecord source and verification

FINDING → LIMITState what is supported

Eight procedural steps apply the seven-element chain.

PROCEDURE

Eight steps with explicit decision points.

The eight-step examination is distinct from the seven-element conceptual evidence chain.

Question

State the claim to be examined.

Scope

Identify system, version, period, environment and exclusions.

Control context

Identify requirements and criteria.

Evidence

Identify records actually available.

Provenance

Establish origin, system state and time.

Verification

Check evidence against defined criteria.

Finding

State support, contradiction or unresolved status.

Limitation

Preserve conditions constraining the conclusion.

STOP RULE

Insufficient evidence remains insufficient.

A missing source, broken chain of custody, contradictory record or unsupported inference may prevent the requested conclusion. The record should state that boundary rather than supply a substitute claim.

OUTPUT

A finding tied to scope and record.

The examination result identifies the question, evidence base, checks undertaken, finding and material limitations. It can be revisited when the system or evidence changes.

ILLUSTRATIVE SYNTHETIC RECORD

Keep the original finding and its later review linked.

This example illustrates record structure. It is not client work or an ODA3 examination result.

R-001 / ORIGINAL EXAMINATIONEvidence cutoff: T₀

Was the unauthorized action blocked in the defined test?

Scope: One test build, one action and one stated environment.
Evidence: Test protocol and synthetic event log with build and time context.
Finding: The examined attempt was blocked under the stated conditions.
Limit: No production observation or evidence for other builds or periods.

R-001.1 / LINKED REVIEWLater evidence: T₁

A new build creates a new evidence question.

Trigger: System version changed after the original cutoff.
Relationship: References R-001; the original record remains intact.
New status: No conclusion for the changed build until new records are examined.
Notably absent: No evidence that the first finding transfers to the new build.

A linked review adds a new dated record. It does not silently rewrite what the earlier evidence supported.

APPLY THE METHOD

Start with evidence readiness.

The Pilot offers a bounded route for identifying whether the existing record can support the question.