Every number, traced: how a 200-page report stays auditable.

The problem with long reports

A 200-page report holds more facts than anyone will read twice. No reader checks them all. A careful reader checks a few: the number they already know, the company they used to work at, the market they follow. If one of those is wrong, the other pages lose their standing. A long report is only as strong as the easiest number in it to check, so every number has to be ready to be checked.

More care at the end helps less than it seems. What helps is a structure in which each number carries its own proof from the moment it is written. The structure has five steps, and the rule behind them is short: a number that cannot show where it came from does not ship.

1. Save the source as it stood

Web pages change and filings get amended. A link to a live page proves only that the page exists today, not what it said when the report was written. So each source is saved at the moment it is read, and the saved copy gets a fingerprint: a SHA-256 hash, which the federal standard defines as a 256-bit message digest¹. Written out in hexadecimal, that is 64 characters. The standard says what makes it useful: "Any change to a message will, with a very high probability, result in a different message digest"¹. If the saved copy is altered later, its fingerprint will, with that same very high probability, stop matching.

Courts rely on the same idea. The Federal Rules of Evidence let data copied from an electronic file be authenticated "by a process of digital identification", with a certification from a qualified person², and the committee note to that rule says such data are ordinarily authenticated by hash value: if the hash values of the original and the copy differ, the copy is not identical to the original³.

2. Tie each number to its place

A source alone is not enough, because a single filing can run to hundreds of pages. Each number points to where it sits: the document and the page, and where it helps, the table and the row. For a filing with the SEC, the submission already has a permanent name, its accession number, which EDGAR assigns automatically to every accepted submission⁴; the pointer adds the document within it and the page. A reader who has both can go straight to the figure.

A number the report works out for itself, such as a growth rate, a share of a total or a sum across companies, carries its inputs and its arithmetic. The reader can redo the sum instead of trusting it.

3. Recheck every quote word for word

Paraphrase drifts, and a quote that drifts puts words in someone's mouth. Each quote is matched against the saved copy of its source, word for word. A quote that does not match is corrected from the source or cut.

4. Keep conflicts in the open

Good sources can disagree: a company's website and its filing, a press release and a public register, last year's report and this year's. Averaging them produces a number neither source supports. So the conflict is logged, both values are kept, and the report says which one it uses and why. A reader who trusts the other source can see it and decide.

5. Review apart from the author, then cut what fails

The author of a claim never approves it. Rival review systems, each blind to the others, read material work. Every finding is kept, none is voted away, and a named partner signs off⁵. A claim that fails is rewritten from its source or cut, and a report ships only when its claims pass.

What the checks catch

The structure earns its cost in what it stops. On diligence work, asking each claim where it came from has turned up a government award that the awarding body's own register did not have, an executive role at an institution that had closed two decades earlier, a "fully permitted" plant whose approval had moved to another company, and a patented system that turned out to be two abandoned applications. Each read well on the page. Each failed when the claim had to show its source⁶.

Each was caught by going back to the record the claim depended on and reading what it actually said.

How to audit one yourself

A reader does not have to take any of this on trust. Pick three numbers from a traced report: one you already know, one that surprises you, and one that carries a conclusion. For each, follow the pointer to its source, open the saved copy and check that the figure is there, on that page, saying what the report says it says. For a worked number, redo the arithmetic from its inputs. If all three hold, the structure is doing its job. If one fails, that is a finding in its own right, and it is worth raising before anything else in the report.

What tracing does not promise

Tracing does not make a source true. A number can be traced perfectly to a filing that is itself wrong, and a register can lag behind the world it records. What tracing gives a reader is narrower and more useful: for each number, where it came from, what the source said when it was read, and a way to judge it for themselves. That is what makes a 200-page report auditable. It is also why it can be read in pieces: a reader who checks one number and finds it holds has a reason to trust the next.

The same method sits under the rest of our research, from how an investor's mandate is read (is this an investor?) to where each state keeps its company and lien records (what the 50 states publish).