Why this becomes difficult to defend
The decision exists. The basis for it may not be retrievable as one record.
The investigator is reviewing a change control record for a validated system modification. Approvals are in the system. The investigator asks who made the regulatory impact determination.
The change control documents approvals and implementation steps. It does not document who evaluated regulatory impact as an authorization decision — or what evidence they used.
What must be retrievable
The reviewer needs more than the final outcome.
- Named individual accountable for the regulatory impact determination
- Regulatory standards evaluated during impact assessment
- Evidence reviewed to support the impact classification
- Authorization timestamp for the impact determination
- Reasoning for why the change was classified at its assigned level
Relevant proof
See how the record connects evidence, judgment, risk, and authorization.
A completed ComplianceWorxs record shows the reasoning layer that is usually hardest to reconstruct after the decision has been made.
When this is your active decision
Preserve the reasoning before the context disappears.
Use the completed proof first. When the decision is consequential enough to preserve, create an Inspection Response Record for the actual decision.