Can a Performance Review Trace Every Input to Its Source?

Research question: can an administrator prepare a performance-review packet in which every included input can be traced to its source, period, author, and approved use, while leaving evaluation and employment decisions with the manager? Review cycles often pull together goals, work measures, feedback, attendance records, training events, and prior notes. A clean packet can still be misleading if dates, populations, or authorship disappear during consolidation.

Provenance means more than a link. For this protocol, each input records the originating system or document, stable reference, author or system owner, creation date, covered period, definition, version, approved viewer, transformation, and known limitation. If an administrator converts weekly counts into a quarterly total, the record preserves the formula and denominator. If a manager supplies narrative feedback, the packet identifies it as manager-authored judgment rather than an objective system fact.

The Philippine privacy framework applies because review packets contain personal information and can include sensitive context. Its implementing rules address proportional processing, organizational security, access management, human-resource supervision, retention, and processor contracts. These sources support asking why an input is collected, who can see it, and how it is protected. They do not decide whether an input is appropriate, accurate, nondiscriminatory, or lawful in a particular employment process.

Method: build fifty synthetic review packets across customer operations, records support, scheduling, reporting, training coordination, and payroll preparation. Each packet covers a declared period and role. Seed wrong-period measures, changed denominators, duplicate feedback, anonymous notes without approved handling, obsolete goals, manager edits attributed to the worker, late corrections, inaccessible sources, and complete controls. Use artificial identities and no live employment records.

Two reviewers reconstruct every packet against a locked source register. They label each input verified to its source, transformed reproducibly, conflicting, outside period, outside approved scope, inaccessible, or unknown. They do not rate the worker. A separate seeded answer key identifies the planted condition. Review order is randomized, and the study records whether familiarity with a system changes accuracy. Reviewers must cite the precise source and rule for each status.

The main measure is provenance coverage: the share of included inputs whose source and transformation another reviewer can reproduce. That number is reported with conflicts and unknowns, not as a standalone quality score. Secondary measures include false attribution, wrong-period inclusion, denominator mismatch, unauthorized-view detection, reviewer agreement, and preparation time. A packet with fewer inputs may be stronger if each input answers the declared question and preserves its limits.

Facts, calculations, observations, and judgments occupy different fields. A system may report twelve closed tickets under its definition. A calculation may derive a rate from that count and a documented denominator. A manager may observe that certain work needed correction. A judgment may evaluate performance under an approved process. Combining those statements into one narrative destroys the distinctions a reviewer needs. The coordinator can format and cross-reference them but cannot convert one type into another.

Population rules come before results. A ticket measure must name which queues, statuses, dates, duplicates, reopened items, and transferred work count. A scheduling measure must say whether cancellations and time-zone changes are included. If the definition changes during the period, preserve both versions and route the comparability question. The coordinator should not choose whichever definition produces the more favorable number or fill missing source data with an estimate unless the owner has approved a documented method.

Narrative inputs require provenance too. Record who authored the note, when, for which period, and under what approved channel. Do not treat copied text as independent corroboration. A later summary should link the original and identify the summarizer. If the source is anonymous or restricted, the packet records that constraint and follows the owner's process. The coordinator must not investigate identity, promise confidentiality, or decide how disputed feedback affects employment.

Access tests cover the packet and its by-products. Review whether calendar reminders reveal review status, shared spreadsheets expose other workers, exported PDFs retain hidden comments, or email drafts include restricted inputs. Minimum necessary access may differ for the coordinator, manager, reviewer, HR owner, and worker. The experiment records observed access and routes mismatches. It does not decide disclosure rights or broaden permissions to make packet preparation easier.

Analysis reports each failure class by packet type. A sensitivity check removes inputs with unresolved provenance and shows how the descriptive record changes, without deciding which version should govern. If a conclusion changes materially, the packet states that it depends on unresolved evidence. If it does not change, that does not validate the manager's judgment. It only shows stability under the declared synthetic treatments.

Corrections are evaluated as events. When a source owner repairs a ticket count, goal date, or authorship label, the packet links the old and new values, reason, authority, and affected calculation. It does not overwrite history. Reviewers test whether derived tables refresh consistently and whether a narrative summary still cites the obsolete value. The coordinator may run the approved refresh and flag remnants. The reporting or HR owner decides whether the correction changes an evaluation or communication.

Late inputs need a cutoff rule. Some feedback will arrive after packet preparation, and some source systems will backdate records. The register shows received time, effective period, and owner disposition separately. Reviewers do not insert a late item simply because it concerns the period, nor exclude it merely because the packet is already formatted. They apply the approved rule and route exceptions. A sensitivity view may show the packet with and without the item, but it cannot select the governing treatment.

The method checks whether measures encourage hidden work. If a count rewards closed items, reopened or transferred work may disappear. If an average excludes unresolved cases, the packet may look better as the queue deteriorates. Synthetic cases therefore include open, reopened, duplicate, transferred, and cannot-determine records. Reviewers verify numerator and denominator treatment against the locked definition. This is a provenance check, not a claim that any particular metric is suitable for evaluating a person.

The coordinator's role is bounded: maintain the cycle calendar, population list, source register, reminders, version history, completeness checks, and exception queue. The manager or authorized HR owner defines evaluation criteria, interprets evidence, addresses disputes, approves ratings, communicates outcomes, and decides any employment action. Automation does not change that boundary. A generated summary still needs provenance and an accountable reviewer.

Limitations: synthetic packets omit team context, qualitative work, shifting assignments, bias, protected activity, accommodations, local legal duties, and the emotional weight of a real review. A reproducible source can still be irrelevant or unfair. Reviewer agreement can reproduce a bad codebook. The seeded frequencies do not estimate live error prevalence. A live test needs privacy and employment-process review, correction rights, access controls, and a stop rule.

Decision use: the output is a review-packet schema and a list of unresolved sources, not a performance score. A buyer comparing performance-review coordination should ask how definitions are locked, transformations are shown, restricted inputs are handled, corrections are preserved, and manager judgment remains attributable. That makes administrative support inspectable without pretending the coordinator or software has made the employment decision.

Sources checked September 18, 2026: National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012 (https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/); National Privacy Commission, Republic Act No. 10173, Data Privacy Act of 2012 (https://privacy.gov.ph/data-privacy-act/); Department of Labor and Employment, Labor Code of the Philippines, DOLE Edition 2022 (https://dole.gov.ph/labor-code-of-the-philippines-2/); National Institute of Standards and Technology, Cybersecurity Framework 2.0 (https://doi.org/10.6028/NIST.CSWP.29); National Institute of Standards and Technology, Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide, SP 1326 (https://doi.org/10.6028/NIST.SP.1326). These are primary government sources. They provide legal text and control guidance, but they do not approve a provider, interpret a particular contract, or decide an employment matter.