Name the search before interpreting it
Suppose an auditor searches for a payment and receives no matching records. That result can be consistent with several histories: the payment never occurred; the source did not record it; the record was not retained; it was outside the query; or the auditor did not receive it.
A useful report identifies the question, sources, selection rule, time interval and cutoff. It also distinguishes an empty answer from an unavailable source, an incomplete search or an assessment that did not run. These conditions lead to different next steps.
Coverage needs its own grounds
To reason from absence to non-occurrence, the reporting arrangement must justify why a relevant occurrence would have produced an observable record in the assessed scope. The assurance depends on the applicable failure and threat models, including whether the actor could bypass capture or suppress delivery.
A signed list can protect the list that was supplied. It does not, by itself, show that no relevant entry was withheld before the list was formed. A timestamp can bind a record to a time statement under a particular mechanism; it cannot invent records that were never captured.
A bounded example
Illustrative case: the question concerns transactions accepted by one named payment service during a specified interval. A declared capture rule covers those transactions; the evaluator obtains the expected source records through a defined cutoff and checks the applicable completeness premises.
If those premises hold, absence may support a conclusion within that service, interval and transaction class. It does not establish that no payment occurred through another service, outside the interval, or through a path excluded by the capture rule. Any stronger statement requires stronger coverage grounds.
Keep the conclusions separate
This separation also makes follow-up work concrete. The next step may be to recover an unavailable source, correct a query, assess a capture boundary, or narrow the claim. It is not always to repeat the underlying action: an operation with an unknown outcome may already have completed.
- What was searched: the evidence set and exact scope.
- What the search returned: records, no matches, or an incomplete result.
- What coverage premises were assessed and what remains assumed.
- What proposition the available evidence supports, fails to support or refutes.