Why this becomes difficult to defend
The decision exists. The basis for it may not be retrievable as one record.
The investigator is reviewing a risk assessment for a product or process change. Risk scores are documented. The assessment is closed. The investigator asks who authorized the risk determination.
The risk assessment documents scores and mitigations. It does not document who evaluated the risk methodology, reviewed the evidence, and made the formal authorization that the residual risk was acceptable.
What must be retrievable
The reviewer needs more than the final outcome.
- Named individual accountable for the risk authorization decision
- Evidence reviewed before the risk level was authorized
- Regulatory standard applied to the risk acceptability determination
- Authorization timestamp for the risk acceptance
- Reasoning for why residual risk was determined to be acceptable
Relevant proof
See how the record connects evidence, judgment, risk, and authorization.
A completed ComplianceWorxs record shows the reasoning layer that is usually hardest to reconstruct after the decision has been made.
When this is your active decision
Preserve the reasoning before the context disappears.
Use the completed proof first. When the decision is consequential enough to preserve, create an Inspection Response Record for the actual decision.