# Payroll evidence worksheet

Proposed investigation/tabletop aid. Fictional references are not vendor log fields.
Never record complete banking details or secrets here. Use restricted evidence references.

- Coordinator / incident reference:
- Employee reference and authorized mailbox-to-employee mapping:
- Timezone and conversion method:
- Mail request reference, sender account, recipient, time:
- Mailbox rule reference, conditions, actions, creation/change time:
- Matching message location and evidence of how it moved (or unknown):
- HRIS request versus stored state: which is actually available?
- HRIS audit reference, recorded account, field, effective time, destination labels:
- Evidence identifying the human operator (or unknown):
- Payroll batch reference, destination label, status definition:
- Payment disposition and authoritative source: held / submitted / rejected / returned / confirmed paid / unknown:
- Last proven outcome:
- Unresolved claim, assigned owner, response deadline:
- Identity, mailbox, HRIS, and payroll response owners:
- Evidence preserved and containment actions taken:
- Retest: legitimate request proceeds; unresolved request held/escalated; resulting state verified:

## Fictional packet answer
R-10 / M-11 / M-12 / H-20 / P-30 / P-31 show a stored change and a prepared batch held before submission. They do not establish payment or human attribution. Message location does not alone prove rule processing. Removing P-31 makes disposition unconfirmed; substituting a request for H-20 leaves the stored change unresolved.