THE GOLD STANDARD OF INTELLIGENCE · SPECIALIST STUDY
Turn repeated RDS recovery incidents across sites into shared prevention without erasing local conditions
A site can recover from heightened review and still reveal the same mechanism elsewhere: an offline package that expired, a contradictory translation, a device that missed a release, or an ownership gap that delayed participant remedy. Cross-site governance compares these events only after aligning protocol versions, exposure opportunity and observation windows. It distinguishes shared protocol and device causes from local implementation, traces participant and estimator exposure, sequences corrective action around common dependencies and preserves justified exceptions. Portfolio closure requires evidence that the shared mechanism and the local variants have both been tested.
This guide belongs to the Intelligence subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Define the cross-site portfolio · chapters 1, 2, 3
Classify shared and local mechanisms · chapters 4, 5
Protect participants and analytical outputs · chapters 6, 7, 8
Sequence corrective action and challenge evidence · chapters 9, 10, 11
Close the portfolio and monitor recurrence · chapters 12, 13
The whole problem at a glance
| Portfolio question | Required evidence | Unsafe shortcut |
|---|---|---|
| What truly recurs? | Versioned mechanism taxonomy | Same alert code |
| What is shared? | Protocol, device and release map | Same vendor |
| Who is exposed? | Participant and estimator lineage | Case count |
| What may close? | Common and local changed-context tests | All sites trained |
A common symptom can arise from different mechanisms, and a common mechanism can appear through different symptoms.
CHAPTER 1 OF 13 · Define the cross-site portfolio
1. Define the recovered-site recurrence portfolio
Include post-recovery events that challenge a successor control, protocol release, device state, owner route, participant remedy or estimator safeguard across two or more sites.
Evidence record: List event IDs, site, protocol and control versions, dates, devices, cases, participants, outputs, immediate protection, recovery evidence and inclusion rule. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Freeze a reviewed portfolio cut; late events enter an amendment or next cut rather than changing the denominator silently. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A third site reports a late offline package after review begins; add a versioned amendment. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- Define the decision unit for “Define the recovered-site recurrence portfolio”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 2 OF 13 · Define the cross-site portfolio
2. Normalise opportunity, timing and site context
Align field periods, recruitment waves, device inventories, offline duration, connectivity, language, staffing, supervision and surveillance coverage without discarding local chronology.
Evidence record: Retain raw site records, mapping rules, missing fields, exposure opportunities, monitoring changes, operating constraints, uncertainty and reviewer disagreement. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Compare recurrence against opportunity and observability, not raw event counts alone. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A remote site has fewer alerts but longer offline intervals; normalise before judging it safer. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- Define the decision unit for “Normalise opportunity, timing and site context”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 3 OF 13 · Define the cross-site portfolio
3. Separate recurrence from rediscovery
Distinguish a mechanism returning after verified repair from an old affected device, unresolved case or stale remedy queue discovered later. Both matter but imply different action.
Evidence record: Record first existence, first detection, repair version, verification, later observation, identity resolution, backlog status, participant effect and classification confidence. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Do not call a rediscovered old case a new control failure or hide it from participant remedy because the mechanism predates closure. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A device found in storage still has the old package; classify backlog rediscovery while testing admission controls. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- Define the decision unit for “Separate recurrence from rediscovery”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 4 OF 13 · Classify shared and local mechanisms
4. Build a mechanism taxonomy across sites
Classify protocol contradiction, release propagation, expiry enforcement, offline state, device admission, case quarantine, acknowledgement, remedy, owner coverage and analytical bridging.
Evidence record: Store taxonomy version, definitions, examples, exclusions, primary and contributing mechanisms, evidence, consequence, confidence and adjudication. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Code the mechanism and escape path, not only the visible alert or responsible team. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The same stale module may arise from failed prepositioning at one site and disabled expiry at another. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- Define the decision unit for “Build a mechanism taxonomy across sites”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 5 OF 13 · Classify shared and local mechanisms
5. Map shared protocol and device dependencies
Link events to control-library releases, translations, packages, distribution services, device images, beacons, identity, sync queues, vendor support and training.
Evidence record: Maintain dependency IDs, versions, rollout cohorts, owners, logs, tests, failures, recovery, local overrides and unknown relationships. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Treat one shared dependency as portfolio risk when its failure can reach several sites. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A packaging service supplies every site; its release receipt requires cross-site validation. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- Define the decision unit for “Map shared protocol and device dependencies”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Worked recurrence portfolio
| Site observation | Shared hypothesis | Local factor | Portfolio action |
|---|---|---|---|
| Expired offline module | Release enforcement | Long travel interval | Expiry fixture |
| Contradictory translation | Control-library propagation | Local addendum | Language comparison |
| Late participant remedy | Ownership workflow | Vacant supervisor role | Backup-owner gate |
| Estimator hold repeat | Case quarantine rule | Delayed sync | Release rehearsal |
Portfolio action should not erase a local remedy or participant obligation.
CHAPTER 6 OF 13 · Protect participants and analytical outputs
6. Trace participant exposure and remedy completion
Identify interviews, incentives, privacy notices, consent, referrals, recontact and remedy actions affected by recurring control weakness.
Evidence record: Record participant-safe identifier, site, event, protocol version, exposure, consequence, remedy, communication, refusal rights, completion evidence and unresolved issue. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Participant protection does not wait for an estimator effect, and portfolio aggregation never replaces site-level remedy. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A case used an obsolete referral script without changing survey data; complete participant remedy anyway. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- Define the decision unit for “Trace participant exposure and remedy completion”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 7 OF 13 · Protect participants and analytical outputs
7. Bound estimator and analytical-output exposure
Trace affected cases into weights, recruitment trees, exclusions, datasets, estimates, reports and releases. Compare results with and without affected records.
Evidence record: Preserve case lineage, version, estimator role, sensitivity method, thresholds, outputs, release decisions, uncertainty, reviewer and unresolved effects. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Do not claim no analytical impact from a small count without design-aware sensitivity and propagation review. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A few high-degree recruiters alter network weights more than their count suggests. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- Define the decision unit for “Bound estimator and analytical-output exposure”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 8 OF 13 · Protect participants and analytical outputs
8. Maintain local exceptions without normalising drift
A site may need a temporary language, connectivity, staffing or device exception. Bind it to scope, reason, compensating control, participant safeguard, analytical hold and expiry.
Evidence record: Store exception version, authority, site, affected modules, duration, evidence, monitoring, burden, renewal, owner and automatic stop condition. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: An exception cannot become a hidden permanent protocol branch; expiry or changed use triggers reapproval. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A low-connectivity site uses a longer sync window with stricter beacon review and an estimator hold. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- Define the decision unit for “Maintain local exceptions without normalising drift”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 9 OF 13 · Sequence corrective action and challenge evidence
9. Sequence corrective action around common dependencies
Prioritise shared release, device, translation and ownership mechanisms before duplicating weak local fixes, while retaining urgent site protection and remedy.
Evidence record: Publish dependency graph, common-cause reach, consequence, current controls, owners, milestones, rollback, site prerequisites, test fixtures and residuals. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: A common repair does not close local backlog or remedy; sequence both with visible handoffs. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Fix package expiry centrally, then clear each site device estate and participant queue. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- Define the decision unit for “Sequence corrective action around common dependencies”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Portfolio-closure gate
| Gate | Pass evidence | Reopen when |
|---|---|---|
| Mechanism | Shared cause tested | New site recurrence |
| Protection | Participant route complete | Remedy ageing |
| Analysis | Estimator effect bounded | Output exception |
| Locality | Exception expires safely | Workaround becomes normal |
A quiet site is not proof when it had little exposure or weak surveillance.
CHAPTER 10 OF 13 · Sequence corrective action and challenge evidence
10. Test the shared mechanism in changed site contexts
Exercise new and old devices, online and offline intervals, multiple languages, supervisor overrides, delayed sync and participant-remedy routes across representative sites.
Evidence record: Capture fixtures, hidden conditions, expected and observed actions, timing, scope, false results, case and estimator holds, local variation and independent review. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Claim transfer only for tested site and device classes; untested combinations stay residual. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Move an expiry fixture from an urban Android cohort to a remote iOS offline cohort. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- Define the decision unit for “Test the shared mechanism in changed site contexts”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 11 OF 13 · Sequence corrective action and challenge evidence
11. Run independent cross-site challenge
Give independent reviewers raw events, taxonomy, denominators, dependency maps, participant remedies, estimator sensitivity, exceptions and tests. Ask them to reproduce rankings.
Evidence record: Document independence, samples, recomputed measures, alternate classifications, hidden fixtures, discovered site gaps, challenged closure and unresolved limits. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Portfolio closure cannot rely only on central owners or on local teams confirming their own controls. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Withhold one site override from the summary and test whether device and case evidence exposes it. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- Define the decision unit for “Run independent cross-site challenge”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 12 OF 13 · Close the portfolio and monitor recurrence
12. Close common and local actions separately
Close shared protocol or device work only after common mechanisms pass; close each site only after estate, case, participant, output and exception evidence is complete.
Evidence record: Publish action IDs, shared and local scope, tests, remedy completion, analytical decision, residuals, owners, closure authority, surveillance and reopen triggers. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Partial completion produces partial closure; do not force all sites into one date. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The central package closes while one site remains open for device recall and participant recontact. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- Define the decision unit for “Close common and local actions separately”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 13 OF 13 · Close the portfolio and monitor recurrence
13. Operate recurrence surveillance after closure
Monitor protocol uptake, device beacons, expiry, deviations, remedies, estimator holds, local exceptions and new site onboarding. Exercise portfolio owners.
Evidence record: Maintain surveillance windows, denominators, canaries, thresholds, exception ageing, owner drills, independent samples, trend review and automatic reopening. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so another reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Reopen when a shared mechanism recurs, a site loses coverage or an exception outlives its evidence. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the protected mechanism, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A new site joins with inherited devices; test admission, release and remedy routes before ordinary operation. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- Define the decision unit for “Operate recurrence surveillance after closure”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Contents · Previous chapter · Return to the Intelligence guide
Verification lab: work the decision twice
Build a four-site recurrence portfolio and separate new recurrence, backlog rediscovery and local variation.
Map shared protocol and device dependencies, trace participant and estimator exposure and sequence common plus site-specific actions.
Run one changed-context cross-site fixture, independent hidden-exception review and a partial portfolio-closure decision.
Limits and misconceptions
Same symptom does not prove same cause
Classify mechanism, escape path and local context.
Small case counts can still matter
Participant harm and network-weight influence are not proportional to count.
Central repair does not close local obligations
Clear devices, cases, remedies and exceptions by site.
Silence is not transfer evidence
Use exposure opportunity and surveillance coverage.
Questions readers ask
When should RDS events become a cross-site portfolio?
- When repeated mechanisms, shared dependencies or participant and estimator consequences require coordinated prevention.
How is recurrence separated from rediscovery?
- By device and case identity, chronology, verified repair and whether the condition existed before closure.
What remains local?
- Device estates, staffing, language, participant remedy, case quarantine and justified exceptions.
How are estimator effects checked?
- Through case lineage, network-aware sensitivity, version comparison and release decisions.
Can sites close at different times?
- Yes. Shared work and each site obligation have separate evidence gates.
What reopens the portfolio?
- Shared recurrence, coverage loss, ageing remedies, estimator exceptions or expired local controls.
Practise, verify and continue
Compare four recovered-site incidents, classify mechanisms and rediscoveries, map shared dependencies, trace participant and estimator exposure, test transfer and close only the evidence-complete scopes.
Apply the method to multi-site field research or public-health surveillance. Preserve participant protection, site context, protocol comparability, analytical lineage and independent challenge.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
RDS heightened-review reinstatement recovery
RDS post-backlog-retirement surveillance
RDS offline-surveillance exception backlog
RDS protocol-deviation trend review
Authoritative sources and scope
CDC NHBS PWID 2024 operations manual
CDC HIV data programme resources
CDC data security and confidentiality principles
CDC National HIV Behavioral Surveillance
CDC sources support standardised operations, respondent-driven sampling procedures, participant safeguards, data security and multi-site surveillance. They do not prescribe this cross-site recurrence framework. Protocol authority, ethics review, consent, privacy, incentives, participant remedy and estimator decisions require actual study governance.