Give the Board Results They Can Verify, Not a PDF They Must Trust

Your findings land as a slide deck. Somewhere in it is a chart saying 41% of one department does not feel safe raising concerns.

Everyone in the room takes that number on trust. Not because they doubt you, but because there is nothing else available to them: no way to tell your chart from a chart with a different number typed into it. That is fine right up until the finding is inconvenient, at which point "where did this come from" stops being a curious question.

01Where the numbers usually come from

A survey tool the client did not choose, accessed through an account they do not control, exported by the firm being paid to produce the finding.

Nobody in that chain is behaving badly. It is just a chain with no independent link in it, and the person most exposed by that is you: when the finding is challenged, your credibility is the only thing backing it.

02What a verifiable result looks like

Publish the results as a signed document instead of only a rendered chart. The document carries:

• the counts, per question and per cohort;
• the cohort definitions actually used;
• the anonymity floors that were in force when it ran;
• a signature made with a key belonging to the client's workspace.

The cohorts are only there when the document is published after the survey closes. One published while it's still collecting carries the whole-survey counts and no breakdowns.

The signature is the part that matters. The signing key sits under the workspace's own key, which we never hold in a form we can open, so we couldn't have produced the signature ourselves. Anyone can fetch the workspace's public key, and anyone can check that this exact set of numbers was signed by that workspace.

Change one count, one percentage, one floor, and verification fails. Not "looks suspicious", fails.

So the client's own security team can confirm the numbers in your report are the numbers the survey produced, without asking you, and without asking the vendor. They do not have to trust either of you. That is what makes it evidence rather than assertion.

03Why the floors belong in the signed part

This is the detail people miss.

"41% of that department" is only meaningful alongside how many people were in it and what the minimum reportable group size was. A number over a cohort of four is not a finding, it is an accusation with a percentage sign. Signing the floors alongside the counts means the document states the conditions of its own validity, and nobody can quietly widen a cohort after the fact to make a number look better or worse.

If your tool shows small cohorts with a warning rather than sealing them, you cannot make this claim at all, because the underlying data was already reportable at a size where it should not have been.

04What to do with it

Attach the document to the report. One line in the methodology section:

Boards do not usually verify. Their security teams sometimes do, and the ones who do remember which supplier made it possible. The value is not in the checking, it is in being the firm whose numbers can be checked.

05The thing underneath

None of this would mean much if the vendor could read individual answers, because then the aggregate is just their word about what they read.

Ours cannot. Answers are encrypted in each respondent's browser before upload, so what is stored is ciphertext and the aggregate is computed and decrypted in the browser of somebody the workspace gave a key to. The signature says this aggregate came from that workspace. The architecture says nobody outside the workspace, including us, saw the answers that went into it.

Together those are a claim about a survey that does not rest on trusting the people who ran it, which is a strange and useful thing to be able to hand a client.

See how an engagement runs.

For related guidance, see confidential vs anonymous surveys, how to run an anonymous employee survey, and anonymity thresholds for small groups.

FAQQuestions people ask