For general counsel, compliance counsel and outside firms
When they ask how the screen was done
The U.S. Sentencing Guidelines (§8B2.1), HHS-OIG's compliance guidance and the FAR all reward the same thing: screening that is documented, dated and repeatable. They do not reward a vendor's assurance that it happened. A receipt is the document — what each official file printed for an exact key or printed name, the file's own date, the read time, and a hash anyone can recompute. We say what was read and what was not. Whether that was reasonable care is your judgment to make and the tribunal's to accept; we will not pretend to make it for you.
The form line — what the receipt is filed behind
When an auditor asks "what does this receipt support," the answer is on the receipt: the requester may name the form line (2 CFR 180.300(a), FAR 52.209-6(c), HUD-2992, 42 CFR 455.436(c)(2) …) and the receipt prints the line, the citation, the official page, what it is for that line and what it does not prove — hashed with the body. The register carries, for each line, the procedure as the regulation writes it with the auditor's test cited (Compliance Supplement Part 3, FAR 9.405, DFARS 252.244-7001, 23 CFR 635.117), the rule text as the eCFR serves it, and the FAC's own count of findings of that type by year. Sector Maps set this out per situation; the Government Desk names the official systems and their published help lines; the dialect defines each term by its section. None of it is a legal conclusion; it is the record and the citation, in the order counsel asks for them.
The Response Packet — every receipt for one party, in date order
By key (UEI, NPI, EIN, CIK, CCN, LEI, CAGE) or by a published name: each receipt's id, read time, SHA-256, the lines that changed between consecutive reads, and any withdrawal we posted. Free, printable, re-runnable from each id.
Sample packet (Wellpath LLC, by UEI) ↗ · JSON: https://alphacovenantholdings.com/api/receipts/packet?key=uei&value=…
The declaration — FRE 902(13) and 902(14)
Every receipt page carries a Certification of process and digest (/api/receipts/{id}/certification/html): the generating process described, the stored body re-hashed on view against the registry digest, an RFC 3161 timestamp over that digest from a public timestamp authority (DigiCert, Sectigo or FreeTSA — token downloadable as .tsr), the platform's Ed25519 signature with its public key in a DID document, Rules 902(13) and 902(14) as printed, and a custodian declaration template. That is the shape the 2017 amendments describe for a self-authenticating electronic record and for data authenticated by hash. Whether it satisfies the rule and the 902(11) notice requirement in a given proceeding is for counsel and the court. For a receipt that may be filed, the Litigation Report adds the system declaration and the replay script. The declaration describes the system; it does not characterise the party.
False Claims Act and bid-protest matters — what the record can and cannot carry
In an FCA matter the question is often what the contractor or grantee knew, or should have known, about a counterparty's exclusion status on the date of award or payment. A dated receipt is third-party, date-fixed evidence of what SAM.gov Exclusions, the OIG LEIE, OFAC and the other files printed for the exact name on that date — or that a file did not answer. The Response Packet (below) lays every read for one party in date order with the lines that changed between reads.
What it cannot carry: any statement that a check was "sufficient", that a party was "eligible", or that a row is the same person or firm. Those are the fact-finder's conclusions. The receipt's own text says so, which is what keeps it usable by either side. See a real receipt, annotated →
Where the record sits in the audit-evidence hierarchy
AU-C 500 (and the GAO Yellow Book, which incorporates it) treats evidence obtained directly by the auditor from an independent, external source in documentary form as more reliable than evidence generated internally or obtained orally. A receipt is external-source (the agency's own file), independent of the audited entity, documentary, dated and re-runnable; an ERP log that "the check ran" is internally generated. The receipt is offered to the auditor as that document — it is not an audit opinion, and it does not test the entity's controls.
What the record says and does not say
Says: the source, its file date, the key or exact printed name used, the rows as printed, the hash, and every source that did not answer or was not read (Known Limits). Does not say: eligibility, identity, "clean", "compliant", or any risk judgment. A same-name row is a candidate for you to resolve. Restricted files — Death Master File, CMS Preclusion, DEA registrant file, FinCEN BOI, Treasury Do Not Pay — are named as not read, never implied.
Where counsel usually starts
Duty Sheets put the dated record beside the rule's own question: all sixteen, including counsel-exclusion-diligence, oig-cpg-monthly, far-52-209-6, occ-tprm-ongoing-monitoring and piia-pre-payment. Contract language that asks for the evidence rather than a representation: the Evidence Clause.
Public-record evidence, not legal advice. Alpha Covenant Holdings is the reader of record and says so on every page; our daily self-check is our own and is not an independent audit.