Skip to content
Both Columns

All notes  /  Investigation

What Counts as Evidence

Attendance records are circumstantial. What they support, what they do not, and the gap where most cases are lost.

Investigation · Reference

Clock data feels definitive because it is precise. Precision and reliability are different properties.

What the record establishes

That a credential was presented at a time.

Not who presented it, unless something else verifies identity.

That a device reported a position within a boundary, at a stated accuracy.

Not that the person was inside the building, where the boundary is larger than the error.

That a shift was recorded as lasting a certain time.

Not what happened during it.

The gap

Every one of the above has an ordinary explanation that is not misconduct.

A card was borrowed because someone forgot theirs. A punch was made from the car park because the terminal was queued. A long shift is a forgotten clock-out.

Which means the record raises a question and does not answer one.

Cases are lost where the employer treated it as an answer.

What turns a question into evidence

Corroboration. A supervisor who saw the person, a colleague, work that was or was not done, a customer record.

Pattern over time, rather than a single instance.

The person's own explanation, obtained before conclusions are formed rather than after.

A working system, demonstrably. If the terminal was faulty that week, the record proves nothing and you need to know that before the meeting.

Photographs and biometrics

A photograph at clock-in is stronger evidence because it addresses identity directly.

And it is a collection about a person with its own obligations, which should have been decided before it existed rather than invoked when needed.

Retrieving footage or images for an investigation needs a basis, a scope and a record — not a browse through the archive.

What to assemble before any meeting

The records at issue, with timestamps and any accuracy figures.

The system's status that week: faults, outages, known issues at that site.

The site's anomaly rate, for comparison.

Any corroboration.

And the person's own account, which frequently ends the matter and should be obtained first.

The test

Could someone reading only your file reach the same conclusion?

If the file is a spreadsheet of timestamps with no context, no.

And that is the file a tribunal, an appeal panel or a union representative will read, which is the reason to assemble it properly rather than after a decision has been made.

The outsider test

One question to ask of any file before acting on it.

Could someone reading only this reach the same conclusion?

If the file is a spreadsheet of timestamps with no context, no.

And that is the file a tribunal, an appeal panel or a representative will read.

Assemble it properly before deciding, not after, because a file built after a decision reads exactly like one.

A practical configuration prompt

During configuration, use transparent screen monitoring software to prompt questions about identifiers, ownership and output. Treat the page as a starting point and document each assumption.

Independent reference

For a thematic point of reference, see NIST. Consult the source directly because technical, operational and legal details change.