IPE and the completeness problem
Accuracy is the cheap half. Completeness is the expensive one.
loomseal.com · Reading
Accuracy is the cheap half. Completeness is the expensive one.
loomseal.com · Reading
When a company hands an auditor a report generated from its own systems, a user list, a change log, an access review export, auditors call it Information Produced by the Entity, and they are trained not to take it at face value. Before IPE counts as evidence, the auditor must establish two properties: the report is accurate, and the report is complete. This is routine in SOC 2, ITGC, and financial audit work, and it is where a surprising share of audit hours actually go.
Accuracy asks whether each row in the report matches the source system. That is sampling: pick rows, trace them back, done. Completeness asks whether every row that should exist is present, which means proving something about records you cannot see. Establishing that nothing was left out of a population is structurally harder than checking what is in it, and the cost difference shows up in every engagement.
Queries re-run while the auditor watches. Screenshots of record counts. Row counts reconciled against a second system. Exports pulled under observation because an export pulled alone might have been filtered first. It is manual, repeated every period, and billed by the hour, and none of it survives the engagement as portable evidence. Next audit, the same dance.
Signed logs, hash chains, and tamper-evident storage all prove records were not edited after being written. None of them prove records were written. A system that quietly declines to log an event produces a record that is intact, fully verified, and misleading, which is exactly the failure completeness testing exists to catch. Integrity tooling, however good, answers the accuracy-shaped question and leaves the expensive half untouched.
Completeness cannot be proven absolutely, because that would be a claim about events that left no trace. What a system can do is commit to its own population as it goes: on a fixed cadence, sign a statement that the record now holds exactly N entries, chained to the statements before it. Now the failure modes have names. A record deleted after being counted contradicts the arithmetic. A counting statement that skips is itself visible. A system switched off during an incident leaves a missing heartbeat instead of an undetectable nothing. Omission stops being silent and becomes either a visible gap or a signed false statement, which is a materially different thing for whoever signed it.
The honest form of the result is a measurement, never a badge: attested every 60 seconds, publicly anchored, longest unattested window 74 seconds, reconciled against sources the entity does not control. That sentence is checkable. A VERIFIED COMPLETE stamp is not.
LoomSeal is an open format for exactly this class of evidence: one portable file carrying records, chain links, external anchors, and a signature, verified offline by a free tool. Its LoomSpan profile adds the population attestation described above, with the coverage measurement printed by the verifier. The rules are public in the spec.