28 August 2026
An index that lists a file is not evidence the file contains anything: what happened when I audited my own governance pack
I spent a day this week auditing my own governance pack, and the thing I went looking for was not the thing I found.
The pack is the internal governance record for a pre-deployment medical digital twin: something in the order of eighty registered documents, each with an identifier, each cross-referenced by others. A few days earlier I had found a single stale identifier that had survived a renumbering twenty days before, pointing readers at an unrelated document while looking entirely legitimate. That is the kind of defect that no search finds, because nothing is malformed. So I wrote a script to check the whole set: are any identifiers duplicated, are any referenced but declared nowhere, and does every link whose label says one document actually resolve to that document.
The answer was clean. No duplicates, no mislabelled links. If the audit had ended there I would have concluded, reasonably, that the pack was in good order.
The finding came from a side effect of the method, not from the method’s purpose. To check identifiers I had to open every registered file. Seven of them were not the document they were registered as. Two had started as working notes and had never stopped being working notes: one, registered and cited across eight other documents as the project’s RACI matrix, opened with an unrelated news summary and continued as dated coaching entries, with real role assignments buried two thirds of the way down. Another, cited as the governance document register, had the same shape and an empty section heading left from an unfinished draft. The remaining five were zero-byte files. They had been listed in the index, with an owner and a status of Draft, for months.
The distinction I want to draw out is not that I had gaps. Everyone has gaps. It is that the index was accurate and the pack was still hollow in seven places. Every one of those files existed. Every path resolved. Every identifier was correctly assigned. The register was telling the truth about location and lying about substance, and no structural check I had would ever have caught it, because I had been checking whether documents were findable and never whether they were there.
Two claims built on top of those files were, as a result, false. A self-assessment I had run against an international reporting framework recorded the governance dimension as Covered, citing the RACI as its evidence. A monthly indicator for overdue reviews named the governance document register as its data source. Both were written in good faith by someone who believed those artifacts existed in the form claimed, and both had to be downgraded: the self-assessment row to Partial, the indicator to a stated method that works from document metadata because its named source does not exist. Writing that downgrade is the most useful thing I did that day. A self-assessment that has never moved in the unfavourable direction is not being checked.
Then the audit turned on the repair. Having written a replacement document register, I checked it against the files it described and found that its approver column, listing a data owner here and a clinical safety owner there, matched nothing. Every one of those documents records the approver as unassigned, and two of the most authority-bearing, the project charter and the decision-rights matrix, carry no approver field at all. The column had been filled with what the allocation ought to be, which for every entry was an entirely reasonable answer, and reasonable is exactly what makes it dangerous: a plausible answer feels like a correct answer, and neither feeling is a reading of the source. I had spent the day identifying places where a governance system satisfied itself on paper, and had then produced one, inside the register whose job was to prevent it. The fix was to split the column in two, one recording what each document actually says and one recording who would have to approve it for the document to carry weight, with the second labelled as not assigned.
Which surfaced the finding underneath all seven: no document in this pack has an assigned approver. Every artifact in it is written, owned and approved by the same person. That is not a documentation defect to be tidied up later. It means the pack can be accurate, careful, internally consistent, and still not governed, because nothing in it has been agreed to by anyone who could have refused. The practical consequence is a rule I now have to keep: these documents may be described as drafted, as in force as a working standard, as applied. They may not be described as approved, and no amount of internal maturity changes that.
The method generalises, which is why this is worth writing down rather than quietly fixing. Three checks, none of which require any tooling beyond a short script, and all of which I would now run against any governance corpus, including one I did not write:
- Existence is not content. For every document a register claims, open it and record its size and its first heading. A file can be present, correctly named, correctly linked, and empty.
- Trace the dependent claims. Where an assessment, indicator, or public statement cites an artifact as its evidence, verify the artifact carries what is claimed. Hollow documents are only half the failure; the claims resting on them are the half that reaches other people.
- Read fields, do not infer them. Any column recording who owns, approves, or signs something must be read from the source and never reconstructed from what the allocation ought to be. If it is an intention rather than a record, label it as one.
I have published the two governance artifacts that survive this best, a dependency register and a public disclosure summary, and both now carry a standing section recording what changed in them and why, including the wording that did not survive scrutiny. That habit came out of the same day. A transparency record that only ever shows its current state cannot be checked, and quietly conceals that an earlier version said something different.
None of this makes the pack better than it was on the morning of the audit. It makes it more accurately described, which is a smaller claim and a more defensible one. If there is a transferable point, it is that the first system worth turning an instrument on is your own, and that the interesting result is rarely the one you set out to measure.