Designing an ESG evidence chain for real operating conditions in West Africa

Activity data and the factor are not the same object. The first describes what happened. The second describes the selected reference used to transform that activity. Merging them into a final value makes recalculation opaque. Separating them makes it possible to change a reference, measure the difference and preserve the previous result with its method.

The factor register contains the metadata of the choice, never a library presented as local. A calculation points to a frozen version. A decision to change version creates a new trace and does not silently alter periods already reported.

Testable decision

Two linked objects, activity and reference, plus a versioned choice log and an explicit recalculation function.

Failure to detect

A test must fail when a result cannot recover the exact reference and the original activity data.

A nullable value is not enough. Absence carries a reason code, an observation date, a person responsible for the next action and, when it exists, material waiting to be read. A photograph of a record is not stored as an illustration. It becomes a source linked to the entry, with its fingerprint, origin and reading state.

Correction preserves before and after. When an image is read again or an invoice arrives, the system creates a new version of the data and closes the absence state. It becomes possible to separate an improvement in collection from a change in activity.

Testable decision

Absence taxonomy, source object, provenance link, reading state and correction history.

Failure to detect

A control must reject a value without a source or an absence reason when the field is expected within the boundary.

The model does not begin with a monthly invoice. It begins with a period, a site and an active energy source. The grid, a generator and any other source occupy intervals that may overlap. Fuel purchases and readings then document those intervals.

This representation prevents an outage from becoming an unexplained absence. It also allows an estimate when the switch time was not recorded, without confusing that estimate with a measurement. The distinction remains visible through reporting.

Testable decision

Switch events, intervals by source, measured or estimated state, records and matching rules.

Failure to detect

A control must flag any operating period with no energy source or an unexplained overlap.

Every local write receives a stable identifier, an expected version and two times: observation and receipt. The server does not overwrite automatically. It compares versions, accepts independent additions and places real conflicts in a resolution queue.

Attachments follow a separate cycle. A structured entry can be received before its image, then move from incomplete to documented. A failed retry sends only the missing fragment. This granularity reduces connection cost and prevents one large file from blocking the whole batch.

Testable decision

Stable identifiers, expected version, local log, acknowledgement, partial retry and conflict resolution.

Failure to detect

An offline test must cause a controlled conflict, never silent loss or an accepted duplicate.

A declared quantity, direct observation, a receipt, a matched payment and a second confirmation are five different paths. The schema preserves the path used. It can then apply a quality rule without turning the outcome into a judgement about the supplier.

The “cannot be evidenced” field is not an exceptional exit. It belongs in the model. It names what is missing, why it is missing and what could change the state. This candour prevents a final aggregation from hiding weaknesses in upstream collection.

Testable decision

Source type, establishment mode, corroboration, explicit limitation and possible revision condition.

Failure to detect

A control must prevent a statement alone from being displayed as equivalent to a record or an observation.

The model stores the original amount as an immutable fact and adds one or more conversions as derived objects. Each conversion carries its rate source, period, rounding rule and use. A report can then select an appropriate conversion without rewriting the transaction.

The accounting date, payment date, mobile-money date and ESG period are not merged. Their relationship is explicit in the lineage. This structure reveals period mismatches and double conversions that would otherwise pass unnoticed.

Testable decision

Immutable source transaction, derived conversions, four distinct times and a link to the relevant activity.

Failure to detect

A control must reject a conversion without a rate source or any report that has lost the original amount.

The system does not need to record every exchange. It does need to preserve the language, the role of the person reformulating, the time of entry and the way meaning was validated. A term kept in the original language can be linked to a note without producing an entire written resource in that language.

Minimisation matters as much as traceability. Audio must not be kept by default. The system preserves only what is needed to understand the transformation and attribute the entry. The person interviewed remains visible as a human source without their words becoming public material.

Testable decision

Collection stages, language, roles, validation of meaning, minimisation and restricted access to notes.

Failure to detect

A control must flag a reformulation with no source language, author or validation mode.