An authentication audit pack should answer a practical question: could another person reach the same bounded conclusion without asking the author what a spreadsheet column meant? A screenshot can support a record, but it rarely preserves the scope, transformations and exclusions needed to reproduce a finding. Begin with one claim, then supply the inputs and reasoning that support it.
State the claim and its limits
Use a claim such as “one of three registered services lacks current evidence of an aligned authentication pass.” Avoid “the domain is secure.” Under RFC 9989, DMARC evaluates authentication with identifier alignment. It does not certify the business purpose of a sender, guarantee delivery or account for every impersonation method.
Define the organization, services, domains, review interval, time zone and evidence cut-off. Separate the inventory denominator from the messages actually observed. A service may be approved yet not appear during a short observation interval. Missing telemetry is a finding about visibility until additional evidence explains it.
Retain a reconstruction path
Preserve raw inputs in a restricted area with collection timestamps and integrity hashes. Record transformations, deduplication keys, exclusions and tool versions. For aggregate reports, retain report identity, reporting organization and interval alongside each extracted row. RFC 9990 describes report structure; a report row is not a complete transaction history or proof of inbox placement.
Link each finding to the exact service-register entry, relevant rows, interpretation and corrective decision. Keep personal content out of a general audit summary. A hash checks whether retained bytes changed; it does not establish authenticity, completeness or an authorized approval. Preserve source provenance and access history separately.
Reconstruct a self-contained hypothetical finding
Assume three registered services: billing, payroll and newsletter. All three have current business approval. Billing and newsletter have current authorized aligned-pass observations within the declared review interval; payroll has none. Under the proposed rule requiring both approval and current evidence, two of three services qualify. Payroll is an evidence gap, not a demonstrated authentication failure. These are stated assumptions, not retained operational files or an executed audit.
Changing only payroll’s assumed observation to a current aligned pass makes coverage three of three. Starting instead from the original case and removing billing’s approval leaves one of three. These separate counterfactuals show how the conclusion depends on inputs. A real reviewer needs actual frozen records and provenance, not just these example sentences.
Give the reviewer a bounded assignment
Ask an independent reviewer to reconstruct the two-of-three result, identify the payroll gap and explain why unobserved is not identical to authentication failure. Give the reviewer the same frozen inputs and rules, then record their identity, result, disagreements and exact input hashes. For a real audit, external reproduction remains pending until a separate reviewer actually inspects the frozen evidence and records the result. Reviewing this article or its hypothetical arithmetic does not satisfy that operational assurance gate.
Close a finding only when its stated closure evidence exists. For payroll, that means a service-owner-confirmed route and a current authorized test with receiver authentication evidence, not deleting payroll from the denominator. Preserve unresolved items, review dates and responsible owners so the next audit can distinguish progress from a changed population.