Reporting, Testimony and Peer Review
Reporting, Testimony and Peer Review
This domain tests whether findings can be understood, defended, and reviewed. The report is the primary deliverable; testimony is a test of its clarity and limits.
Core rules
- Structure the report with purpose and scope, authority, evidence examined, methodology, findings, limitations, conclusions, and appendices. Separate factual observations from expert opinions.
- Use consistent units, time zones, file paths, and hash values. Explain technical terms; avoid absolute language when evidence is probabilistic.
- Peer review should be independent, documented, and cover notes, hashes, tool versions, and conclusions. Technical review and editorial review are distinct.
- Testimony must satisfy Daubert or Frye where applicable. Qualify the expert, explain methodology, and concede limitations under cross-examination.
- Disclose tools, versions, and exculpatory findings. Retain case files and drafts under policy.
Worked example
A draft says, "The user downloaded the file." The artifact only shows a download at a time from a profile. The revised report says, "A download was recorded in the user's browser profile at 14:02 UTC; user attribution requires corroboration." The revision is defensible and avoids overclaiming.
Traps
Offering opinions beyond expertise; using absolute language; ignoring exculpatory evidence; failing to document peer review; being surprised by a tool error because verification was skipped.
Key points
- Reports separate facts from opinions and state limitations.
- Peer review must be independent and documented.
- Daubert and Frye govern expert admissibility.
- Concede limits clearly under cross-examination.
- Disclose tools, versions, and exculpatory findings.