The Gold Standard · Ecology
Make the decision path visible
A reactivation incident may be contained at its source while an approval label continues to live in partner databases, planning spreadsheets, model inputs and copied reports. A recall notice tells holders what should change; it does not prove that the change reached every consequential use.
The gold standard defines the recall population, reconciles system and human evidence, searches for transformed reuse, verifies action at decision gates and states residual exposure before closure.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · DEFINE COMPLETENESS
1. Define the recall object and required action
Name the superseded approval, versions, effective dates, affected site and whether holders must replace, annotate, withdraw, rerun or reconsider.
Without a specific action, a recipient can acknowledge the notice while leaving the risky use unchanged.
CHAPTER 2 OF 12 · DEFINE COMPLETENESS
2. Define the recall population
Combine push lists, access logs, exports, subscriptions, partner agreements, model dependencies and known manual copies. Include likely recipients beyond those visible in the source system.
The population is an evidence-based estimate, not simply the address list used for the first notice.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · DEFINE COMPLETENESS
3. Set a risk-based completeness standard
Require stronger evidence for holders who can authorise field work, public status, compliance or irreversible management. Allow proportionate sampling for low-consequence archival copies.
Complete does not always mean every byte is deleted; it means every material decision path is controlled and residual exposure is explicit.
| Source | What it reveals |
|---|---|
| Send log | Direct recipients |
| Access log | Actual users |
| Export registry | Files and feeds |
| Dependency map | Derived uses |
CHAPTER 4 OF 12 · FIND DOWNSTREAM REUSE
4. Reconcile distribution evidence across systems
Compare sent notices with delivery, access, repository, partner and action records. Resolve identities that differ between systems and record unmatched events.
A perfect email list can still miss an automated feed or a shared folder used without personal accounts.
CHAPTER 5 OF 12 · FIND DOWNSTREAM REUSE
5. Search for transformed and copied reuse
Look for the old status code, threshold, site identifier, derived score, characteristic wording and decision outcome in models, dashboards and reports.
A downstream product may contain no copy of the original file while still carrying its decision effect.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · FIND DOWNSTREAM REUSE
6. Worked example: a recalled approval remains in a habitat model
A retired-rule approval is corrected in the site register and acknowledged by a partner. The partner has already converted it into a binary model input and copied the result into a seasonal habitat-priority map.
The recall team traces the site identifier to the model run, reruns the affected layer, versions the map and checks scheduled work that used the earlier priority. Changed-context check: if a historical model is preserved solely to reproduce a dated study and is clearly isolated from current planning, annotation and provenance may be sufficient instead of replacement.
| Required action | Evidence |
|---|---|
| Replace | Repository version event |
| Rerun | New model output |
| Reconsider | Decision review record |
| Annotate | Visible supersession note |
CHAPTER 7 OF 12 · PROVE REPAIR
7. Verify action at consequential control points
Seek repository events, model reruns, revised briefs, decision-gate checks or accountable attestations that identify the governing version.
A generic reply saying received is evidence of communication, not proof of replacement or reconsideration.
CHAPTER 8 OF 12 · PROVE REPAIR
8. Reconsider affected decisions proportionately
Identify whether the recalled item contributed to the outcome, whether the corrected evidence changes it and whether the decision can still be repaired.
Record unchanged outcomes; they demonstrate that the team checked materiality rather than assumed error or safety.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · PROVE REPAIR
9. Manage unreachable and unverified holders
Use alternate contacts, repository notices and decision-level safeguards. State what may remain, the consequence, attempted routes and the trigger for later reopening.
Silence should neither block every closure forever nor be translated into proof of correction.
| Form | Search key |
|---|---|
| Model input | Site identifier |
| Dashboard | Status code |
| Report | Characteristic wording |
| Plan | Decision outcome |
CHAPTER 10 OF 12 · CLOSE HONESTLY
10. Use independent sampling to challenge completeness
Select high-consequence, unusual and manual routes that the recall team did not choose for convenience. Search for old fingerprints and reconstruct user actions.
Sampling should target plausible blind spots, not merely confirm the easiest successful cases.
CHAPTER 11 OF 12 · CLOSE HONESTLY
11. Run a changed-system transfer check
Move the recall through a new partner, renamed site, updated API and offline field copy. Confirm that identifiers, action requirements and verification survive translation.
A recall process that relies on one current system may fail as soon as data is reformatted or ownership changes.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · CLOSE HONESTLY
12. Close with evidence and a reopen trigger
Summarise population estimates, verified consequential paths, transformed reuse checks, unresolved holders, decision repairs and the event that would reopen the recall.
The gold standard calls a recall complete only to the boundary supported by evidence, not to the boundary suggested by effort.
| Measure | Warning |
|---|---|
| Unmatched export | Population incomplete |
| Old fingerprint | Reuse persists |
| Receipt-only closure | Action unproved |
| Repeat recall | Root repair weak |
Frequently asked questions
Is a 100 percent email response rate enough?
No. It may miss automated feeds, shared repositories and transformed uses, and it does not prove the requested corrective action occurred.
Must every historical model be rerun?
No. Rerun material current or decision-bearing uses; preserve isolated historical versions with clear provenance and supersession.
Can a recall close with unreachable holders?
Sometimes, if consequential paths are controlled, residual exposure and attempted routes are explicit and a later discovery can reopen the record.
Why use independent sampling after acknowledgements?
It tests whether the recall team overlooked difficult routes or accepted weak evidence from high-consequence holders.
Continue through verified routes
Core routes
Ecology subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Reactivation incident containment, cross-system recall and repeat-path prevention
- One-standard drift, legacy rule reactivation and post-retirement surveillance
- Exception retirement, legacy uses and final migration to one standard
- Transition exceptions, sunset review and ending dual standards