Detection Opportunity Audit¶
Test or assessment — instantiates Expected-Absence Signal Interpretation
Checks whether the observer, sensor, search, or communication channel actually could have detected the expected event.
Before a silence can mean anything, someone must have been in a position to hear the noise. Detection Opportunity Audit asks exactly one question: if the expected event had occurred, was there a functioning observer, channel, and access path that would have caught and recorded it? It is a gate on the whole inference. If the answer is no — the sensor was off-coverage, the portal was down, the reporter never had notice or reach — then the absence carries no evidential weight at all, and any conclusion drawn from it is an artifact of a blind spot rather than a fact about the world. The audit inventories the conditions of observability, not the strength of the signal: it establishes whether a channel existed and was live, and stops there.
Example¶
A public-health agency notices that a certain mosquito-borne disease shows zero reported cases across a rural district for a full season, and is tempted to declare the district clear. A Detection Opportunity Audit tests that inference before it is trusted. Auditors reconstruct the observation chain: Did clinics in the district actually stock the diagnostic test kits this season? Were clinicians trained to suspect and code the disease? Was the electronic notifiable-disease portal reachable from those clinics, or had it been offline since a system migration? Did residents have any accessible clinic to attend at all?
The audit finds the blind spot: two of the district's three clinics ran out of test kits in week three and the reporting portal rejected submissions from their older software the entire season. The channel that was supposed to carry positive cases could not have carried them. That verdict flips the interpretation — the zero is not evidence of absence of disease, it is evidence of absence of detection capacity. The right next move is not "declare clear" but "restore the channel, then re-observe."
How it works¶
- Reconstruct the observation chain. Enumerate every link that had to work for an occurring event to leave a record: observer present, instrument in range and calibrated, channel open, access and notice available to the source.
- Test each link for the relevant window. For the specific period in question, verify the link was actually live — not that it usually works, but that it worked then.
- Locate the weakest link. A single broken link breaks the whole opportunity; the audit's output is a verdict — observable or not observable — plus the specific link that failed.
- Bind absence weight to the verdict. Where opportunity is confirmed, the absence may be interpreted; where it is not, the absence is quarantined as uninformative until the channel is repaired.
Tuning parameters¶
- Chain granularity — how many links you decompose the observation path into. Finer chains catch subtle blind spots but cost more to verify each time.
- Evidence standard per link — whether "the sensor was on" needs a log, a spot check, or a reasonable assumption. Stricter standards catch silent failures but slow the audit.
- Window specificity — whether you certify observability for the exact absence interval or for a general period. Exact windows are rigorous; general ones are cheaper and riskier.
- Access-and-notice depth — how far you probe whether human sources could and safely would use the channel. Deeper probing catches suppression and reach failures but shades into a heavier review.
- Re-audit trigger — what change (a migration, a staffing cut, a coverage gap) forces re-certifying a channel that was previously fine.
When it helps, and when it misleads¶
Its strength is that it refuses the most common absence error at the root: reading "we saw nothing" as "nothing happened" when the real story is "we couldn't have seen it." It is the antidote to the streetlight effect — searching only where observation is easy and mistaking the lit patch for the whole territory.[n1] Wherever a green board or a clean report rests on a channel nobody verified, this audit is the check that earns the silence its meaning.
Its failure mode is that establishing an observation channel existed is not the same as establishing it was sensitive enough — a live camera pointed the right way can still be too low-resolution to catch what mattered, and the audit will wave through an opportunity that a sharper test would question. It can also become a rote checklist that certifies "channel nominally open" without confirming the source could actually reach it. The guarding discipline is to keep the audit's remit honest — it certifies opportunity to observe, and it hands the distinct question of statistical sensitivity given opportunity to the power check, rather than pretending a working channel guarantees a decisive one.
How it implements the components¶
observation_opportunity_window— it directly constructs and verifies this: who or what could observe, when, and through which channel.production_process_reference— it models how the event would have been produced and carried (instrument emit, clinician code, portal submit), so it knows which link to test.false_absence_guardrail— a "not observable" verdict is exactly the guardrail firing: it blocks an artificial absence from being scored as evidence.
It does not estimate whether an existing channel had the sensitivity or statistical power to detect the event (absence_likelihood_baseline, absence_threshold_rule, redundant_observation_channel) — that is its hazard-twin Null-Result Power Check; this audit asks whether any channel existed and was live, not how sharp it was.
Related¶
- Instantiates: Expected-Absence Signal Interpretation — supplies the observability gate that every absence interpretation must clear first.
- Sibling mechanisms: Absence Likelihood Dashboard · Confirmation Probe Request · Exception-Lag Review Workflow · Expected Event Register · Missing Heartbeat Monitor · No-Response Escalation Protocol · Null-Result Power Check · Silence Signal Review Board
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Detection Opportunity Audit operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it checks whether the observer, sensor, search, or communication channel actually could have detected the expected event.
Independent corroboration: The frozen evidence defines Detection Opportunity Audit as 'Checks whether the observer, sensor, search, or communication channel actually could have detected the expected event', so its operative form is Assessment, Review & Assurance.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Security Studies & Intelligence Analysis
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Intelligence collection practice most directly established the need to distinguish an evidentiary absence from an unassigned, unavailable, mistimed, or insufficiently reporting collection channel before drawing analytic conclusions.
Related originating lineages:
- Engineering & Design — Instrumentation engineering contributed the observer, sensor, channel, access, and exact-window readiness checks.
- Statistics & Experimental Design — Statistical design contributed the separation of observation opportunity from sensitivity, power, and inference after data collection.
Review resolution: Security and intelligence is primary because its collection-management literature explicitly treats untasked collection and insufficient reporting as gaps that precede analysis. Engineering observability and statistical opportunity-versus-power distinctions materially complete the portable audit.
Attribution caveat: Collection-gap audits, instrument observability, and statistical missingness independently address pieces of the problem; the exact pre-inference checklist is a cross-domain synthesis.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
- CIA Studies in Intelligence: collection gaps and insufficient reporting
- CIA: The Guiding of Intelligence Collection
Notes¶
The audit's verdict is a precondition, not a probe: it asks whether a channel was live, not what a new observation would show. When the audit finds a channel that existed but may have been dead, Confirmation Probe Request is the natural follow-up that actively re-tests it.
[n1] The streetlight effect — the tendency to search where observation is easiest rather than where the answer actually is, from the parable of the man looking for lost keys under a lamppost "because that's where the light is." A detection-opportunity audit maps exactly where the light does and does not fall. ↩