The report

The engagement produces one artefact. Not a dashboard, not a score, not a certificate: a dated document in which every line can be checked by someone who was not present when it was written.

The four-part line

The claim

Something you stated, in writing, before anything was measured.

The method

Precisely how it was tested — the command, the path, the conditions.

The evidence

The raw output, retained unmodified, including the parts that are inconvenient.

The verdict

One of three, and only three.

Three verdicts, of equal rank

Not tested is the one that is unusual to see written down, and it is not a softer form of failure. It means a claim was not verified — because access was not granted, because the window did not permit it, or because the test would have carried a risk we were not authorised to take. It says nothing about whether the claim is sound.

A report with no such lines is asserting a coverage it does not possess. An experienced reader — and the reader who matters is always experienced — will notice, and will discount the whole document accordingly. We would rather hand you a report with visible gaps than one that quietly implies there are none.

What the evidence looks like

Raw, and reproducible. If a port was found closed, the report contains the observation from outside and the packet capture from the host, together with the control that proves the capture was working. If a backup was restored, it contains the table counts from the restored copy next to the table counts in production.

meta.xml    <Databases/>        <-- empty element
SQL dumps   none
production  122 tables

Three lines from our own first report. The archive was the right size, arrived on schedule, and was listed correctly in every automated check. It contained no database.

Totals are calculated, never typed

Every count in the report is derived from the verdict data at the moment of rendering. This sounds like a technicality and is not: in an early revision of our own report, hand-written totals were wrong twice in succession. A document that establishes facts cannot contain a number that nobody measured.

What you receive

The report as a signed PDF, the raw evidence files that produced it, and the declaration it was tested against. All three, together, because the report on its own is an assertion — and an assertion is what we set out to replace.