Use it in four steps
- Enter expected, actual, threshold, and detection details.
- Test possible explanations against evidence.
- State only the finding supported by completed tests.
- Record correction, ownership, prevention, and approval.
Investigation control: a plausible explanation is not a confirmed cause. Record each test, source, result, correction, and approval. Escalate suspected theft, fraud, AML concerns, system defects, or material control failures through the property’s formal procedures.