Documentation: Making the work durable
Phase 7 · continuous from Alert, finalized here
What did we decide, and what did we learn?
Documentation is what makes triage work survive its closure. It runs alongside every other phase and finalizes at closure, recording decisions, evidence, and reasoning so future analysts and auditors can understand what was done and why.
What you will get from this chapter
The three pillars
Standards
Format and structure, clarity and precision, timeliness. The discipline that turns notes into records.
Read →Templates
Alert reporting, timeline tracking, action logs. Templates make documentation fast and consistent.
Read →Pitfalls
Incomplete records, post-hoc rationalization, missing evidence chains. The common ways documentation fails.
Read →Why Documentation deserves its own phase
The work survives the analyst
Tap to revealA documented case can be reviewed, learned from, and used to train new analysts long after the original investigator has moved on. An undocumented case dies with the shift it ran in.
Patterns emerge from records
Tap to revealThree documented cases of the same alert type, in the same week, can reveal a campaign that no single case would show. Documentation is the substrate that makes pattern detection possible at the program level.
Audits are documentation tests
Tap to revealRegulatory audits do not ask “did you do the work.” They ask “can you show that you did the work.” Documentation is the answer either way; without it, the answer is “trust me.”
Reasoning is the deliverable
Tap to revealWhat the analyst decided is half the value. Why they decided it is the other half. Strong documentation captures both. Future reviewers see not just the verdict but the path to it.