Without a specific entry decision there is nothing to reconcile against, and the work is unexplained rather than approved.
Identify the decision that admitted this work. If none exists, classify it as origin-risk.
A decision made without authority is not governance, it is precedent — and it will be repeated.
Name the decision owner and confirm the authority was theirs to exercise.
Email and chat are not reconcilable at scale. If the record lives there, the work is effectively untraceable.
Move the entry record into the system of record and reference it from the work item.
A record created after the fact proves the work happened, not that it was governed.
Compare record timestamp to work start. Flag every case where the record came second.
A signature confirms someone agreed. A condition confirms the work should exist.
Write the entry conditions down, then test this work unit against them.
Unmarked retrofits make a broken population look clean, which is worse than knowing it is broken.
Add a retrofit flag to the record and exclude flagged items from traceability counts.
Recollection leaves when the person does, and it cannot be audited.
Test the reconciliation with someone who was not involved. If they cannot follow it, it is not traceable.
Permanent exceptions are just an ungoverned second entry path with better manners.
Give every exception a written rationale and an expiry date, then review on expiry.
Assuming legitimacy is how a hidden factory stays hidden and stays funded.
Create an origin-risk category and put unreconciled work in it rather than in the clean population.
An assessment tells you how wide. Foundation teaches your people to close them without buying the read again.