A decision log where changing an entry shows DECISION
Numbered decisions with the reasoning beside each one, sealed against the entry before it. Alter one and it stops verifying, and so does everything after it.
The log
A decision
The reasons are the record. A decision without them tells anybody reading it in two years nothing they can use.
Past its review date
The log, newest first
Check it and take it with you
How it works
Every organisation keeps this document under a different name
A senior investigating officer keeps a policy file. A firearms authorising officer keeps a log. A Gold commander keeps one, a local authority keeps one, and a company keeps one from the moment it is being sued. They are the same document: a numbered, running record of decisions with the reasons behind them, written at the time.
And what it is for is not what people assume. The question asked two years later is almost never “was that the right decision”. It is what did you know when you made it, and what else did you consider. A decision can be wrong and perfectly defensible; a decision can be right and indefensible, if nobody can show how it was reached. A log of decisions without their reasoning is not a record of anything.
So each entry here asks for the reasoning, the options that were rejected and why, what the decision rested on, and (the one people leave out) what was not known at the time. That last field is what protects you. “We did not know whether the rear access was covered, and proceeded on the basis that it was not” is a complete answer to a question that otherwise gets answered with hindsight by somebody who has read the outcome.
Two timestamps, and the gap between them
Every entry records when the decision was made and, separately, when it was written down, and shows the difference. That is deliberate and it is uncomfortable on purpose.
A decision logged four hours later is a decision reconstructed, and the reconstruction is honest but it is not contemporaneous. Anybody examining the record will work out the gap for themselves if it is not shown, and finding it hidden is much worse than finding it stated. A log where the gaps are visible and small is evidence of discipline; one with no timestamps at all cannot be distinguished from one written afterwards.
The entries are sealed with a digest so that changing one shows. That does not stop somebody rewriting the log (nothing can); it means the rewritten version no longer matches the digest you recorded at the time, which is what turns “this is my log” into something checkable.
Writing entries that hold up
Write in the first person and in plain words. “I decided to hold the cordon at the junction because…” survives being read aloud. “It was decided that the cordon would be maintained” removes the decision-maker from their own decision, and the first question will be who decided.
Log the decisions you did not take, and the ones you deferred. A deliberate decision to wait is a decision, and an unlogged one looks like inaction. Log the advice you received and from whom, because that is what you relied on.
Number the entries and never renumber them. A superseded decision gets a new entry that refers to the old one; the old one stays. A log with an entry removed is a log that has to explain itself.
Everything stays in this browser until you export it, which means the export is the record. Export at the end of each day and keep it the way you keep the rest. Nearby: STATEMENT seals a witness account the same way, TIMELINE builds the chronology with sources, CHAIN records custody of material, and DEBRIEF is the conversation afterwards.
Doing this often? The OBSCURA Sovereign Suite keeps a change log of who changed which record, and when, across every register. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.