How Should Leave-Balance Source Conflicts Be Researched?

Research question. This study asks whether leave support can reconstruct why balance sources disagree without interpreting entitlement or promising a corrected balance. It creates a buyer-side evaluation method, not a claim about Outsourced Employment or another provider.

Evidence basis. The Philippine Data Privacy Act says personal information should serve declared purposes, remain accurate and relevant, not be excessive, and receive reasonable organizational, physical, and technical protection. Its implementing rules address accountable roles, access duties, processing records, processor arrangements, and review. NIST CSF 2.0 supplies a general vocabulary for governance, identity, data security, detection, response, and recovery. CISA guidance supports least privilege. These are design inputs; owners and qualified advisers interpret them for a real organization.

Unit of analysis. Examine one fictional worker token, leave category, as-of instant, and sequence of opening balance, accrual, use, reversal, expiry, and adjustment events. This narrow unit prevents favorable totals from hiding unsupported transitions. Every conclusion identifies its source event, version, observed time, and accountable next decision.

Test population. Create 120 reconciliations spanning pending requests, partial days, overnight shifts, retroactive approvals, cancellations, imported balances, duplicates, year boundaries, manual adjustments, transfers, and terminated records. Use invented organizations, people, documents, amounts, accounts, and identifiers. Keep the seeded answer key separate through independent review. Record exclusions and reasons rather than silently replacing difficult cases.

Required evidence. Capture worker token, category, source, version, as-of time and timezone, opening value, event ID and type, effective date, quantity, approval, adjustment authority, resulting balance, discrepancy, owner, and acknowledgment. Define purpose and allowed values before testing. Blank, unknown, not applicable, not received, restricted, and cannot determine remain different. Reviewers cannot turn absence into an answer.

Failure hypothesis. The newest timestamp is not automatically authoritative, and arithmetic agreement does not prove correct events. Coordination must not invent accrual rules or turn a manager note into entitlement. Include positive controls that should proceed, negative controls that should stop, and ambiguous controls that should reach an owner. A workflow that never stops is uncontrolled; one that stops every case is unusable.

Decision boundary. Coordinators may freeze extracts, align cutoffs, match event IDs, perform transparent arithmetic under approved mappings, and route. HR, payroll, legal, policy, management, and advisers interpret entitlement and approve changes or responses. Count an unauthorized substantive decision as a serious error even if the guess proves correct. Coordination does not transfer accountability.

Controlled comparison. Randomize case order and compare latest-total reconciliation with event-level reconstruction preserving cutoff, approval, reversal, expiry, and correction lineage. Give both workflows equal information and time. Evaluate correctness, access, serious errors, unresolved work, and duration; speed alone is not success.

Scenario design. Declare an as-of instant and timezone. Seed offsetting half-day errors, a cancellation whose reversal reaches one system, an overnight shift assigned to different dates, and an unapproved correction that makes totals agree. Test the employee-query path without promising an outcome. Require evidence for each transition and preserve late or conflicting signals. The correct response to ambiguity is the named route, not the researcher’s preferred answer.

Evidence drill 1 focuses on worker token. Compare worker token against version at the declared event time, then test whether event ID and type supports or contradicts that relationship. Preserve approval before asking the accountable owner to resolve any conflict involving discrepancy. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 2 focuses on category. Compare category against as-of time and timezone at the declared event time, then test whether effective date supports or contradicts that relationship. Preserve adjustment authority before asking the accountable owner to resolve any conflict involving owner. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 3 focuses on source. Compare source against opening value at the declared event time, then test whether quantity supports or contradicts that relationship. Preserve resulting balance before asking the accountable owner to resolve any conflict involving and acknowledgment. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 4 focuses on version. Compare version against event ID and type at the declared event time, then test whether approval supports or contradicts that relationship. Preserve discrepancy before asking the accountable owner to resolve any conflict involving worker token. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 5 focuses on as-of time and timezone. Compare as-of time and timezone against effective date at the declared event time, then test whether adjustment authority supports or contradicts that relationship. Preserve owner before asking the accountable owner to resolve any conflict involving category. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 6 focuses on opening value. Compare opening value against quantity at the declared event time, then test whether resulting balance supports or contradicts that relationship. Preserve and acknowledgment before asking the accountable owner to resolve any conflict involving source. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 7 focuses on event ID and type. Compare event ID and type against approval at the declared event time, then test whether discrepancy supports or contradicts that relationship. Preserve worker token before asking the accountable owner to resolve any conflict involving version. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 8 focuses on effective date. Compare effective date against adjustment authority at the declared event time, then test whether owner supports or contradicts that relationship. Preserve category before asking the accountable owner to resolve any conflict involving as-of time and timezone. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 9 focuses on quantity. Compare quantity against resulting balance at the declared event time, then test whether and acknowledgment supports or contradicts that relationship. Preserve source before asking the accountable owner to resolve any conflict involving opening value. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 10 focuses on approval. Compare approval against discrepancy at the declared event time, then test whether worker token supports or contradicts that relationship. Preserve version before asking the accountable owner to resolve any conflict involving event ID and type. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 11 focuses on adjustment authority. Compare adjustment authority against owner at the declared event time, then test whether category supports or contradicts that relationship. Preserve as-of time and timezone before asking the accountable owner to resolve any conflict involving effective date. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 12 focuses on resulting balance. Compare resulting balance against and acknowledgment at the declared event time, then test whether source supports or contradicts that relationship. Preserve opening value before asking the accountable owner to resolve any conflict involving quantity. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 13 focuses on discrepancy. Compare discrepancy against worker token at the declared event time, then test whether version supports or contradicts that relationship. Preserve event ID and type before asking the accountable owner to resolve any conflict involving approval. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Evidence drill 14 focuses on owner. Compare owner against category at the declared event time, then test whether as-of time and timezone supports or contradicts that relationship. Preserve effective date before asking the accountable owner to resolve any conflict involving adjustment authority. Reperform the check after a version change and after a delayed acknowledgment. Record the specific source, permissible action, uncertainty, downstream effect, and stop condition instead of replacing the evidence with a yes-or-no completion flag.

Case construction detail. Translate this scenario into individual test cards: Declare an as-of instant and timezone. Seed offsetting half-day errors, a cancellation whose reversal reaches one system, an overnight shift assigned to different dates, and an unapproved correction that makes totals agree. Test the employee-query path without promising an outcome. On each card, show only the information that the real role would possess at that moment. Withhold later events until their timestamp arrives. This prevents hindsight from improving a classification and reveals whether the operating record can support the decision when it is actually needed. Keep the hidden expected route, serious-error class, and permitted evidence beside the answer key, not in the reviewer interface.

Causal review. For every incorrect or delayed result, trace the chain through these required elements: worker token, category, source, version, as-of time and timezone, opening value, event ID and type, effective date, quantity, approval, adjustment authority, resulting balance, discrepancy, owner, and acknowledgment. Identify the earliest unsupported transition instead of blaming the final user. Classify whether the cause was an unavailable source, ambiguous definition, stale version, excessive permission, missing acknowledgment, incorrect mapping, or action outside the written boundary. Re-run only the affected cases after a versioned correction and retain the first result so improvement is measurable rather than reconstructed.

Decision usefulness. The buyer should receive evidence about source coverage, event matching, false agreement, cutoff classification, duplicates, unexplained value, adjustment authority, response latency, and agreement. Convert those measures into a decision table that shows the observed fact, denominator, uncertainty, consequence, accountable owner, and proposed next test. Do not roll serious boundary violations into one average score. A fast median can coexist with a small number of unacceptable disclosures or decisions, while a slower result may reflect appropriate stops on ambiguous cases. State both the operational benefit and the control cost.

Boundary challenge. Apply adversarial examples to this division of responsibility: Coordinators may freeze extracts, align cutoffs, match event IDs, perform transparent arithmetic under approved mappings, and route. HR, payroll, legal, policy, management, and advisers interpret entitlement and approve changes or responses. Ask reviewers what they can prepare, what they may observe, what requires approval, what must stop, and what should never enter the routine record. Score the evidence trail as well as the answer. A correct escalation with no preserved source or recipient acknowledgment is incomplete; a perfectly documented action outside the permitted lane is still a failure.

Alternative explanation. Before accepting the primary conclusion, test whether the same result could arise from The newest timestamp is not automatically authoritative, and arithmetic agreement does not prove correct events. Coordination must not invent accrual rules or turn a manager note into entitlement. Compare that explanation with source timestamps, versions, permissions, and acknowledgments. Mark inference as inference and preserve competing explanations when the evidence cannot choose between them. This discipline matters because a plausible operational narrative can otherwise harden into an unsupported fact that later reviewers, systems, or employee communications repeat.

System-path review. Replay every scenario through the primary record, email, calendar, notification, download, integration, audit log, and backup path that might carry the same information. Record propagation time, mismatched identifiers, stale copies, recipient scope, and acknowledgments. A clean main screen cannot compensate for an uncontrolled export or dependent system still acting on an old state.

Temporal review. Repeat selected cases when a cutoff passes, an owner changes, a source is corrected, or acknowledgment arrives late. State changes only when declared evidence exists. Record the observer, applicable rule version, and dependent-system result. This separates an overdue item from a superseded one and a corrected source from a correction actually received.

Recovery review. Remove a required source, delay an owner, add a duplicate, and interrupt an integration. A controlled workflow preserves last-known state, says what cannot be determined, avoids reconstructing facts from memory, and uses the approved contingency. Work resumes without double action, silent closure, or broader disclosure.

Measurement. Report source coverage, event matching, false agreement, cutoff classification, duplicates, unexplained value, adjustment authority, response latency, and agreement. Give counts with denominators. Separate observed facts, rule classifications, owner decisions, and researcher inference. Preserve disagreement and missing evidence rather than averaging them into a confident-looking score.

Privacy and security. Use fictional workers and quantities; exclude medical details, diagnoses, family circumstances, documents, compensation, and manager commentary. Record who can view, change, export, and delete each artifact. Check whether revoked access survives elsewhere. Stop on unexpected sensitive information and use the approved incident path.

Repeatability. Give a second reviewer written rules and clean cases without coaching. Low agreement indicates unclear definitions, missing evidence, or inconsistent access. Version clarifications and rerun affected cases; do not label every disagreement a training problem.

Acceptance. Set minimum accuracy, maximum unresolved age, acceptable agreement, and zero-tolerance events before opening the answer key. Report each independently. Strong averages cannot offset an unauthorized decision, exposure, or false closure hidden in a total.

Procurement use. Ask a provider to demonstrate a sanitized register, permission view, version history, exception path, acknowledgment, and audit export for this workflow. Every artifact has a date and scope. A policy, demo, or marketing statement is point-in-time evidence, not proof of continuous operation.

Limitations. This does not calculate entitlement, judge a request, interpret policy, or establish a balance owed to a worker. Synthetic cases simplify behavior, platforms, contracts, and cross-border operations. Begin a live pilot with a small approved queue, least-privilege access, named reviewers, monitored exceptions, and a stop rule. The defensible conclusion is whether evidence remains reviewable and uncertainty reaches the correct owner—not whether the workflow guarantees a legal, security, payroll, privacy, employment, or business result.

Sources checked September 28, 2026: National Privacy Commission, “Republic Act 10173 — Data Privacy Act of 2012,” https://privacy.gov.ph/data-privacy-act/; National Privacy Commission, “Implementing Rules and Regulations of the Data Privacy Act of 2012,” https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/; National Institute of Standards and Technology, “The NIST Cybersecurity Framework (CSF) 2.0,” https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20; Cybersecurity and Infrastructure Security Agency, “Identity and Access Management: Recommended Best Practices for Administrators,” https://www.cisa.gov/sites/default/files/2023-12/ESF%20IDENTITY%20AND%20ACCESS%20MANAGEMENT%20RECOMMENDED%20BEST%20PRACTICES%20FOR%20ADMINISTRATORS%20PP-23-0248_508C.pdf. These sources provide principles, not a finding that a provider complies.