Evidence Pack Maintenance Protocol 2.3D.4-1

An evidence pack assembled once and then abandoned becomes a snapshot. A snapshot is not proof of ongoing practice. Proof of practice requires maintenance — regular updating, verification, and evolution.

This sidebar provides a maintenance protocol for keeping the evidence pack alive at the enterprise scale. It connects to the four evidence packs that demonstrate practice across all scales (individual, team, organization, and enterprise), the governance charter that defines authority structure, the encoded objective law assessment that audits moral constraints, the crisis charter that pre-commits emergency authority to restraint, the hazard scan that identifies organizational vulnerabilities, and the sunset schedule that builds fallibilism into institutional design.

The Maintenance Mandate

The evidence pack is a system, not a document. Systems require maintenance in four dimensions. Data must remain current with organizational reality, so that artifacts stay aligned with what the organization actually does. Integrity must be preserved, so that artifacts remain accurate and contradictions are resolved rather than papered over. Accessibility must be sustained, so that artifacts remain discoverable and available to stakeholders. Learning must be continuous, so that artifacts are examined regularly for insights about what works and what does not.

Responsibility for maintenance is non-delegable. This is not something handed to a communications department or compliance team. This is owned by organizational leadership. The evidence pack is proof of governance. Governance is not something you delegate.

Maintenance Cadence: The Calendar

Different artifacts update at different frequencies. The key design principle is that something is updated every month. The organization is always actively maintaining its evidence pack. This prevents the pack from becoming a historical artifact rather than a living record.

Monthly Maintenance (Week 1 of Each Month)

Finance attestations require publication of a monthly spend report showing actual expenditure against budget. Each report must verify that no variances exceed ten percent without explanation. Exceptions must be flagged and documented. The CFO signs the attestation, making this an act of direct leadership accountability.

The decision log must be reviewed for the past month. Are all significant decisions being logged? Does the rationale behind each decision make sense? Are decisions being made transparently, or are they being made privately and then rationalized retroactively?

Feedback integration requires review of feedback mechanisms from the past month — one-on-one conversations, retrospectives, surveys, informal complaints. The organization must summarize what feedback was received, from whom, about what. It must document what actions resulted from that feedback.

Character assessment (individual scale) requires leadership to reflect on decisions made this month. Each person asks: Am I practicing the virtues I committed to? Where did I fall short? What will I do differently?

Quarterly Maintenance (End of Each Quarter)

Governance charter review determines whether the charter remains accurate. Have new authority pathways emerged? Have authority definitions become ambiguous? Do constraints that worked in the past still work, or have they been circumvented? If amendments are needed, they are scheduled.

Exit specifications require review of whether exit costs and options have changed. Update cost estimates. If any participants exited this quarter, test the exit process with them. Did they have the experience promised? Could they actually export their data? Migrate their work? Leave without hidden friction?

Encoded objective law assessment requires a spot audit on key conditions. For traceability: are records being kept append-only, or have records been rewritten to hide history? For auditability: can a third party independently verify the organization's claims about its practice? For survivability and recoverability: test whether backups can actually be recovered and whether succession plans actually work?

Privacy assessments ask: Are there new data sources? Are there new purposes for existing data? Have policy changes affected how privacy is protected? Update privacy impact assessments accordingly.

Capability assessment (team scale) asks: Do we have the skills and knowledge for what we are committing to? What development is needed? Update training plans and capability gaps.

Semi-Annual Maintenance (End of Quarters 2 and 4)

Resilience drills require conducting an adversarial drill in Q2 (focused on cyber and security scenarios) and another in Q4 (focused on business continuity or governance scenarios). Publish results and remediation plans. This is not theater — drills must be designed to fail in instructive ways.

Feedback mechanisms require a comprehensive review of all feedback from the past six months. Are there patterns? Are there recurring concerns? Are there emerging issues that the organization is not hearing because feedback is being suppressed?

Exit rights require a spot check. If people have exited the organization, what was their actual experience? Could they actually export their data? Migrate to a competitor? Leave without being sued? Collect their feedback on the exit experience. Publish results.

Annual Maintenance (End of Q4)

Complete evidence pack audit must verify that all required artifacts exist, that they are current within their scheduled intervals, and that they are accurate. Identify what is missing or what needs regeneration.

Governance charter amendment (if needed) is based on a year of actual governance. After observing how the charter works in practice, does it need updating? Propose amendments to the board. Document the reasons for each change.

Public finance annual audit requires an independent auditor to review all budget, spending, exceptions, and reconciliations for the entire year. The auditor publishes findings. This is not internal review — it is external verification.

Crisis charter review and amendment examines whether emergency authority was invoked this year and what was learned. If it was invoked, what should change in the charter based on that experience? If it was not invoked, what scenarios should the organization be better prepared for?

Strain-condition reassessment revisits the eight organizational strain conditions. Which is the biggest vulnerability? What is the organization doing about it? Are monitoring mechanisms working as designed?

Board review and planning requires the board to review the evidence pack as a whole. What does the pack show about organizational practice? What are the gaps? What will be priorities for the next year?

Stakeholder communication requires explicit decisions about what will be published. What artifacts are public? What artifacts are internal-only? What summary or narrative will be created to help stakeholders understand the evidence pack?

Maintenance Operations: Who Does What

Different artifacts are owned by different teams. But maintenance is not their sole responsibility — they have operational work to do. Maintenance must be efficient and integrated into normal operations. A distributed responsibility model with central coordination prevents both diffusion and bottleneck.

The evidence pack coordinator (typically the Chief Governance Officer if that role exists, or the General Counsel) maintains the master list of artifacts and update schedules. This role tracks which artifacts are due for update, ensures that updates happen on time, coordinates cross-artifact coherence (if governance changes, does privacy policy need updating?), and manages the accessibility and publication of the pack.

Artifact owners (defined in the evidence pack guidance at the organization, team, and individual scales) maintain their specific artifact to schedule. They ensure accuracy and completeness. They propose amendments or revisions when the evidence itself shows that reality has changed. They gather evidence supporting the artifact.

Board and leadership provide oversight of the evidence pack quarterly. They review the pack, authorize amendments to the governance charter, approve resilience drill plans, and make strategic decisions about what evidence is published versus private versus available only to specific stakeholders.

Integration into Operations

Maintenance does not add forty hours per week to the organization's work. It is integrated into normal operations. Monthly spend report (CFO): two hours. Done as part of normal CFO reporting. Formatted for evidence pack publication. Decision log (decision-makers): thirty minutes per month per person. Done during decision documentation, not as separate work. Resilience drills (Chief Risk Officer): forty hours per quarter. Scheduled in advance. Treated as critical infrastructure maintenance. Annual audit (external auditors): eighty hours. Scheduled and budgeted annually, like normal audit. Governance charter amendment (General Counsel): twenty hours per year, or more if amendments are substantial. Amortized across the year.

Maintenance is real work. But it is not separate work. It is how you do governance seriously.

Detecting Maintenance Failure

How does an organization know if maintenance is failing? Warning signs appear before complete degradation. Artifacts become stale when they have not been updated in months or years. If the governance charter was last updated in January 2025 and it is now March 2026, maintenance has failed. Contradictions appear when the governance charter says "board approves all hiring above five people" but HR records show the CEO hired ten people without approval. New capabilities are not captured when the organization creates a data governance team (which did not exist last year) but the evidence pack does not mention it. External parties cannot find artifacts when an investor asks "what is your governance structure?" and the organization must respond "I'll email it to you" instead of "it is published on our website." Learning has stopped happening when resilience drills identify problems, leadership promises to fix them, but next year's drill shows the same problems.

Leadership has become disconnected from the pack when leaders make decisions without consulting the evidence pack. The pack has become a compliance document rather than a tool for understanding organizational practice.

Recovery Actions if Maintenance Fails

If maintenance failure is detected, the organization should acknowledge it immediately. Do not hide degradation. Publish: "Our evidence pack is out of date and we are fixing it." Assign temporary ownership to a specific person (not a role, a person) with authority and time to catch up. This is usually when nobody is clearly responsible. Schedule a catch-up session, blocking the time necessary for a comprehensive update — typically forty to eighty hours, depending on the size of the pack. Publish the degradation: "Our evidence pack became outdated. We have identified these gaps and here is our remediation plan. We will be current by [date]." After catch-up is complete, reset the regular maintenance schedule. Do not let failure become permanent.

Stakeholders understand that organizations sometimes get behind on documentation. They do not forgive cover-up. Acknowledging degradation and fixing it is far more credible than maintaining an out-of-date pack while pretending it is current.

Using the Pack for Learning

Maintenance is not just data entry. It is learning. At each quarterly maintenance review, the organization should ask what the evidence pack is actually telling it.

Do decision logs show that decisions are being made transparently? Are rationales clear? Are decisions aligned with stated values, or is the organization drifting from its principles? Finance artifacts should reveal whether the organization is spending on what it says matters. Are variances explained? Is the budget reflecting reality, or is there a widening gap between what was promised and what was allocated? Governance artifacts should reveal whether authorities are respecting the boundaries in the charter. Are overlaps creating productive friction or paralyzing conflict? Feedback artifacts should reveal what the organization is NOT hearing. Are certain voices being suppressed? Are concerns being raised but not acted on? Resilience artifacts should reveal what drills have shown. Is the organization fixing problems identified in drills, or is it repeating the same failures?

These questions surface misalignment between stated practice and actual practice. That misalignment is valuable feedback, and it should be acted on.

Consider an example. The budget charter says "personnel decisions require consultation with operations and audit." The decision log shows the CEO hired a director-level person without consulting either. Finance audit shows the salary was forty percent above the budgeted band. The evidence pack reveals a misalignment. Either the charter is being ignored (governance failure) or the charter is unrealistic (architecture failure). Either way, something needs to change. The organization can enforce the charter by reversing the hire and reprimanding the CEO (nuclear option, probably not). Or it can amend the charter if the board believes the CEO authority should be broader and document why. Or it can improve compliance if the charter is good but it is not being followed. The evidence pack made the misalignment visible. That is its purpose.

Communicating the Pack to Stakeholders

Maintenance includes communication. The pack is only useful if people know it exists and can access it.

Public artifacts should be published broadly: the governance charter (all employees should know how governance works), resilience drill results (public proof of preparation), public finance attestations (if the organization is regulated), strain-condition reviews (demonstrations of self-awareness).

Internal artifacts should be available to employees but not publicly: decision logs and meeting minutes (which may contain strategic detail), privacy assessments (which may contain sensitive detail), conflict resolution records (which are privacy-protected).

Stakeholder artifacts should be available on request to specific parties: exit specifications (for departing participants or customer prospects), encoded objective law assessments (for investors or regulators assessing governance), crisis charters (for regulators assessing preparedness).

Private artifacts should not be shared: personal character assessment, compensation models (which may contain individual detail), strategic plans (which confer competitive advantage).

Accessibility requires a dedicated section of the organization's website or intranet for the evidence pack. It should be organized by artifact. Each artifact should be dated. Each artifact should be searchable. The organization should set expectations about publication schedule: when is new content available? Monthly? Quarterly? Annual? Each artifact should include a brief summary: what is this, why does it matter, what does it show? The organization should provide a feedback mechanism: how can stakeholders respond to the pack? Challenge a governance decision? Request clarification on an assessment?

If artifacts become out of date, the organization should communicate the degradation transparently: "Our evidence pack maintenance fell behind. Our governance charter was last updated in January 2025; it is now March 2026. We are updating it this month and expect to be current by April. Apologies for the lag. We are re-prioritizing evidence pack maintenance to prevent this in future." This is more credible than silence or hiding the degradation.

The Practice: Evidence Pack as Living System

An enterprise practicing Resilient Objectivism at this level operationalizes the principle that evidence of practice requires ongoing maintenance. It does this by establishing a maintenance calendar with monthly, quarterly, semi-annual, and annual updates on a transparent schedule. It distributes ownership across artifact owners while a coordinator ensures coherence across the pack. It integrates maintenance into normal operations so that the work becomes part of how the organization functions. It actively detects degradation through regular monitoring. It uses the pack for learning, reviewing what the organization is actually doing versus what it claims to do. It communicates to stakeholders, publishing artifacts so that stakeholders can examine the practice.

The practice is not claiming to have perfect governance. It is maintaining the evidence that demonstrates how governance actually works, warts and all. Over time, the pack becomes the organization's honest mirror — showing where practice aligns with principle and where it diverges. That honesty is what builds trust with stakeholders, with participants, and with the organization's own leadership. An organization that knows its governance and can demonstrate it is far more resilient than an organization that claims to have good governance but cannot show the evidence.