Fable
The government office had two accountants: one locked the cabinets, one applied labels
The county office warehouse employed two accountants. Old Zhao managed the tin cabinet—all records of silver in and out were written in a thick ledger, which was locked in the tin cabinet once filled. The cabinet had three locks, with keys held by three different people; opening required registration, closing required a signed seal. Old Qian managed the sticky notes attached to each account entry—which day, who handled it, how much was approved, and which expense item it went to. The notes were arranged by date, so when the inspector came, he could flip through them chronologically.
One year, the warehouse was short 800 taels of silver, and the inspector sent people to investigate. The auditor first had Old Zhao open the cabinet, verified that the seals had not been touched, and the records in the cabinet matched the intake slips—but the records only showed how much was received and how much was paid out, not who signed or who approved. There was no way to find out who had handled it. Then he checked Old Qian's sticky notes and found that three notes had been torn off and rewritten—the dates did not match, and the handler and approver were inconsistent.
Neither ledger helped. Old Zhao's cabinet had intact seals, but its records were too coarse, missing who handled the money. Old Qian's sticky notes were detailed, but had been tampered with. The county magistrate called the two together and asked one question: should the warehouse ledger guard against someone altering it, or should it help the inspector investigate? Old Zhao said my cabinet guards against alteration; Old Qian said my sticky notes help investigation. The two were not answering the same question.
The magistrate later made a decision: Old Zhao would keep locking the cabinet, but each record would gain fields for the handler and the approver. Old Qian would keep sticking notes, but after sticking them, each note would be cross-numbered against Old Zhao's records—the number on the note had to match the line number in the iron cabinet's records. That way, to change a note you first had to open the cabinet and change the number, and to change the cabinet you had to tear off the note and renumber it at the same time.
A new problem appeared two years later. The vault upgraded its silver storage management system, and every silver deposit and withdrawal automatically generated a record. The system designer had only built Old Zhao's part—records were locked once written and could not be deleted or modified. But they had not built Old Qian's part—there were no detailed fields for who did what operation at what time. When the inspector came again, he found that records were tamper-proof, but could not determine which operation was a mistake and which was intentional.
The system designer later added an audit module that extracted behavioral dimensions from the tamper-proof records—operation time, operator, operation type, operation object—and generated an audit view arranged along a timeline. He wrote in the design document: tamper-proofing ensures evidence credibility, auditing ensures behavior traceability. A system should do both, but the two have different starting points for field design.
Later a note was posted on the warehouse door: before entering, first determine whether you are looking for tamper-proof evidence or queryable behavioral records. For evidence, go to the metal cabinet; for records, go to the sticky notes. Taking the wrong ledger does not count as auditing.