THE GOLD STANDARD OF INTELLIGENCE · SPECIALIST STUDY
Transfer an offline-surveillance backlog without losing devices, participant obligations or analytical limits
An RDS field-surveillance programme can reach the end of a release period with open exceptions: devices that never sent a trustworthy beacon, grace-window actions awaiting review, participants exposed to mixed protocol modules, delayed remedies and analytical decisions held for unresolved lineage. Changing the control owner does not make that backlog smaller. A safe transfer freezes the denominator, classifies each exception by consequence and evidence, protects participants before administrative convenience, preserves estimator holds until exposure is bounded and requires the successor to demonstrate control with a live changed-context exercise. Backlog retirement is earned item by item and mechanism by mechanism, not by moving records into a new queue or reporting a lower count.
This guide belongs to the Intelligence subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Freeze and classify the backlog · chapters 1, 2, 3
Resolve beacons and grace use · chapters 4, 5
Repair mixed modules and remedies · chapters 6, 7, 8
Transfer analytical controls · chapters 9, 10, 11
Prove ownership and retire · chapters 12, 13
The whole problem at a glance
| Backlog question | Required evidence | Unsafe shortcut |
|---|---|---|
| Which devices are missing? | Issued-fleet denominator | Connected devices |
| What did grace permit? | Action-level receipts | Grace count |
| Who needs remedy? | Participant exposure reconstruction | Protocol version only |
| Can ownership transfer? | Successor exercise | Signed handover |
A smaller visible backlog can reflect lost evidence rather than resolution.
CHAPTER 1 OF 13 · Freeze and classify the backlog
1. Freeze the backlog at an evidence cut
Create an immutable snapshot of open exceptions, device and site denominators, participant obligations, analytical holds, owners and evidence availability. Continue recording later changes as linked events.
Evidence record: Record cut time, release, device fleet, sites, modules, languages, open states, severity, evidence links, access limits, participant dependencies and analytical scope. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Do not transfer from a live dashboard whose denominator and categories can change without trace. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A device synchronises after the cut; add the event and resulting review without rewriting the handover snapshot. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- State the decision unit for “Freeze the backlog at an evidence cut”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 2 OF 13 · Freeze and classify the backlog
2. Classify exception type and consequence
Separate missing beacon, late beacon, grace-window use, override, mixed module, delayed synchronisation, participant remedy and estimator uncertainty. One field event can create several linked exceptions.
Evidence record: Retain identifiers, timestamps, protocol versions, local and central receipts, recruitment actions, participant state, compensation, chain links, severity and confidence. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Route by consequence and uncertainty, not queue age or the convenience of the receiving team. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: One mixed-module case may need participant contact, data quarantine and an estimator hold as distinct actions. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- State the decision unit for “Classify exception type and consequence”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 3 OF 13 · Freeze and classify the backlog
3. Keep a reconciled denominator
Reconcile issued, spare, repair, replacement, lost, shared and retired devices across inventory, site logs, identity systems, support tickets and local attestations. Offline and missing devices remain in scope.
Evidence record: Preserve device state, custodian, site, issue and return records, expected package, last contact, local storage, loss report, evidence source and unresolved discrepancy. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Never calculate closure rate only from devices that reported successfully. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A spare tablet was used during an outage but omitted from the central fleet; add it before measuring beacon coverage. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- State the decision unit for “Keep a reconciled denominator”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 4 OF 13 · Resolve beacons and grace use
4. Resolve missing beacons by evidence strength
A beacon should bind device, package manifest, module versions, language, policy, local time and cryptographic or operational integrity where supported. Use staged alternatives when direct synchronisation is unavailable.
Evidence record: Collect signed beacon or manifest, controlled photo, local export, supervisor attestation, device inspection, clock state, custody and later central reconciliation. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Accept substitute evidence only for a defined interval and consequence, with later reconciliation required. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A remote site sends a photographed manifest; allow bounded continuity but keep final closure pending device inspection. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- State the decision unit for “Resolve missing beacons by evidence strength”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 5 OF 13 · Resolve beacons and grace use
5. Review overdue grace-window actions
Reconstruct why grace was invoked, which actions were permitted, what the device actually allowed, whether participant safeguards remained active and when the exception should have been reviewed.
Evidence record: Retain trigger, approved grace rule, local receipt, action sequence, blocked functions, supervisor contact, delay reason, expiry, participant effect and review outcome. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: An expired review is an open control exception even when the underlying field action was permitted. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Consent data were captured during grace but coupon issuance was blocked; review each action rather than labelling the whole session compliant or non-compliant. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- State the decision unit for “Review overdue grace-window actions”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Worked exception backlog
| Exception | Evidence state | Protective action | Closure route |
|---|---|---|---|
| Missing beacon | Device issued | Locate and restrict | Attested inventory |
| Overdue grace | Consent blocked | Review action | Supervisor decision |
| Mixed modules | Participant exposed | Quarantine case | Remedy plus lineage |
| Unknown estimator impact | Chains affected | Hold release | Sensitivity review |
Participant protection should not wait for a final estimator calculation.
CHAPTER 6 OF 13 · Repair mixed modules and remedies
6. Reconstruct mixed-module exposure
Map the modules actually displayed or executed in order, including consent, interview, coupon, payment, language and referral components. Do not infer full package state from one version label.
Evidence record: Preserve module hashes or versions, screen sequence, timestamps, local transitions, server receipts, interviewer notes, participant identifiers under approved controls and reproduction test. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Quarantine only the affected records and chains when scope can be bounded; broaden when module lineage is unknown. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Current consent and stale coupon training require different remedy and analytical treatment. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- State the decision unit for “Reconstruct mixed-module exposure”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 7 OF 13 · Repair mixed modules and remedies
7. Protect participants before backlog convenience
Assess whether the exception changed information, consent, privacy, payment, referral, results return or ability to withdraw. Provide approved remedy through safe contact routes and record completion or justified inability.
Evidence record: Document obligation, risk, contact authority, preferred and safe channel, attempts, remedy offered, acceptance, completion, complaint path and unresolved safeguard. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Do not close a participant obligation because the device or data issue is technically repaired. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A payment screen failed offline; restore entitlement without requiring the participant to repeat sensitive survey answers. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- State the decision unit for “Protect participants before backlog convenience”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 8 OF 13 · Repair mixed modules and remedies
8. Separate participant remedy from data disposition
A record can require correction, quarantine, exclusion or retained-with-limitation independent of the participant remedy. Keep scientific and human decisions linked but separately authorised.
Evidence record: Capture case lineage, affected variables, protocol departure, participant action, data-quality assessment, disposition, rationale, approvers and reversibility. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Do not use analytical usefulness to dilute a participant protection obligation. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A participant receives the owed remedy while the record remains quarantined pending module-lineage review. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- State the decision unit for “Separate participant remedy from data disposition”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 9 OF 13 · Transfer analytical controls
9. Place estimator holds where exposure is unresolved
Identify recruitment chains, sites, periods, languages and variables affected by unresolved exceptions. Pause only analyses whose validity or interpretation depends materially on that exposure.
Evidence record: Retain chain mapping, inclusion rules, coupon lineage, network sizes, missingness, weighting inputs, release dependency, sensitivity plan, owner and review date. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Use a bounded hold rather than either releasing everything or freezing unrelated analyses. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Hold a site-period estimate while allowing unrelated sites with verified packages to proceed. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- State the decision unit for “Place estimator holds where exposure is unresolved”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Ownership and retirement gate
| Gate | Pass evidence | Remain open when |
|---|---|---|
| Denominator | Fleet reconciled | Missing devices |
| Remedy | Obligation completed | Participant unresolved |
| Analysis | Exposure bounded | Unknown lineage |
| Successor | Changed-context exercise passed | Escalation untested |
A signed acceptance without evidence access is administrative transfer, not operational ownership.
CHAPTER 10 OF 13 · Transfer analytical controls
10. Run sensitivity and bridging analyses honestly
Compare plausible treatments: exclude affected cases, include with flags, repair derivable fields, alter chain links or vary assumptions. Report which conclusions change and which remain stable.
Evidence record: Preserve analysis code, input snapshot, inclusion variants, weight construction, diagnostics, uncertainty, result differences, reviewer challenge and decision. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Sensitivity evidence informs release; it does not retroactively make an unknown protocol exposure compliant. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A prevalence estimate is stable but recruitment-homophily metrics shift; limit the release claim accordingly. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- State the decision unit for “Run sensitivity and bridging analyses honestly”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 11 OF 13 · Transfer analytical controls
11. Transfer evidence access, authority and calendars
Give the successor the actual registers, device access, local evidence routes, ethics and privacy authorities, participant remedy procedures, analytical holds, vendor contacts and review calendars. Test permissions before cutover.
Evidence record: Record outgoing and incoming owners, scope, open items, repositories, credentials, approvals, calendars, escalation tree, exceptions, acceptance and access-test results. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Keep outgoing accountability until the successor can retrieve evidence and perform a real control action. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The successor can view the dashboard but not encrypted device exports; the transfer remains incomplete. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- State the decision unit for “Transfer evidence access, authority and calendars”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 12 OF 13 · Prove ownership and retire
12. Exercise successor control in a changed context
Present a novel but realistic exception: a replacement device, delayed beacon, different language, mixed module or participant remedy across sites. Observe detection, triage, protection, analysis routing and escalation.
Evidence record: Retain scenario, hidden fixture, expected path, timestamps, observed actions, evidence captured, misses, coaching boundaries, independent observer and retest. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: A tabletop discussion is useful preparation but does not prove operational control when live evidence paths are available. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Use a newly issued spare with a stale language module and delayed sync to test the full chain. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- State the decision unit for “Exercise successor control in a changed context”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 13 OF 13 · Prove ownership and retire
13. Retire backlog items and the heightened process separately
Close each item with evidence and then decide whether enhanced backlog governance can retire. Retain recurring mechanisms, unresolved exceptions, steady-state metrics and automatic reopening triggers.
Evidence record: Publish item decisions, mechanism trends, residual counts, denominator, participant obligations, estimator releases, successor performance, retirement scope, monitoring and triggers. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Do not hide open cases by moving them to ordinary support queues without preserving consequence and ownership. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Retire daily command review while one missing-device class remains under a named monthly exception process. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- State the decision unit for “Retire backlog items and the heightened process separately”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Contents · Previous chapter · Return to the Intelligence guide
Verification lab: work the decision twice
Build a frozen backlog snapshot for six fictional devices, including a spare, a repair unit, one missing beacon and one mixed-module case.
Trace a grace-window case into participant remedy, data disposition and a bounded estimator hold without collapsing them into one status.
Transfer the register to a successor and run a changed-context exercise using a stale translation module on a replacement device.
Limits and misconceptions
The reporting population is not the device denominator
Offline, lost and missing devices remain part of coverage.
Technical repair does not complete participant remedy
Human obligations need their own evidence and authority.
Sensitivity analysis does not erase protocol departure
It bounds analytical consequences only.
A signed handover is not operational ownership
The successor must have access, authority and tested capability.
Questions readers ask
What belongs in the exception backlog?
- Every unresolved device, action, participant, data or analytical state created by offline-surveillance evidence.
Can substitute beacon evidence close a device?
- Only when policy allows it for the stated consequence and later reconciliation is completed.
When should an estimator release be held?
- When unresolved protocol exposure could materially change validity, weighting or interpretation for a bounded analysis.
Does every exception require participant contact?
- No. Contact depends on an approved safeguard or remedy obligation and safe, proportionate procedures.
When is ownership transferred?
- After the successor has evidence access, authority, calendars and passes an operational exercise.
How does the backlog retire?
- Item by item with evidence, followed by a separate decision on the heightened review process.
Practise, verify and continue
Transfer an RDS offline-surveillance exception backlog across missing beacons, overdue grace review, mixed modules, participant remedies and estimator holds while preserving the denominator and successor accountability.
Apply the method to another multi-site field survey with intermittent connectivity. Preserve the distinction between device state, participant obligation, data disposition and analytical release.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
RDS offline-release field surveillance
RDS offline-readiness and protocol-release assurance
RDS stale-protocol incident response
RDS protocol-control library versioning
Authoritative sources and scope
CDC guidance on respondent-driven sampling implementation and monitoring
CDC NHBS-HET2025 Operations Manual
CDC Field Epidemiology Manual on data collection and management
CDC Field Epidemiology Manual on protocols, safeguards and quality checks
CDC sources support RDS operations, monitoring, checklists, recruitment controls, field data management, participant safeguards and quality review. They do not prescribe this offline beacon or backlog-transfer framework. Examples are fictional; ethics, consent, privacy, compensation, contact, disclosure and statistical decisions require the governing protocol and competent review.