Can a reply-handling report be reproduced from its source records?

Question and scope

This brief asks whether a reply-handling report can be rebuilt from its source records by a reviewer who did not produce it. It tests the method, not the commercial quality of the replies.

Choose one report and one period. Reproduce the count of replies, the classification of each reply, and the count excluded from the denominator.

Definitions and case key

Write the definitions for a reply, a positive reply, an opt-out, a referral, and an auto-reply. Then assign one case key per reply and keep it stable across the inbox export and the CRM.

A definition that depends on the reviewer's memory is not reproducible. Include one example and one non-example for each class so a second reviewer can apply the rule.

Source versions

Record the inbox export date, the CRM export date, the report version, and the person who approved each. If a label changed during the period, preserve the earlier label and add a dated note.

Do not overwrite an earlier classification to match a later report. The difference between the two is evidence about how the definition changed.

Reconstruction test

Have a second reviewer rebuild the report from the sources and the written rules alone. Compare the counts and the case-level classifications, then explain every difference.

A difference is not automatically an error. It may show an ambiguous rule, a missing export, or a legitimate judgment. Classify the cause before changing the report.

Limits and reporting

Reproducibility does not prove the report is useful or that the classifications are correct. It proves that the method can be repeated, which is a precondition for trusting a trend.

Report the reconstruction result, the differences, and the open questions. The sources cited here frame recordkeeping and control practice; they do not validate this specific report.

Sources

1. NIST, Security and Privacy Controls for Information Systems and Organizations
2. NIST Privacy Framework
3. CISA, cybersecurity best practices

Apply the operating question

Use the finding to define one source, output, review owner, and exception path inside a real workflow.