Skip to main content
Records Authority
Category: Audit and Assessment

Integrity Verification

Also known as: Data Integrity Verification
Simply put

Integrity verification is the process of confirming that information has not been changed, corrupted, or tampered with since it was created, sent, or stored. In recordkeeping, it provides assurance that a record still reflects its original state and can be trusted as evidence. It does not, on its own, address whether the information was accurate to begin with or who is authorized to access it.

Formal definition

Integrity verification is the process of obtaining assurance that information has not been altered in an unauthorized manner since its creation, transmission, or storage. In a recordkeeping context, it supports the integrity property that, together with authenticity, reliability, and usability, distinguishes an authoritative record from a mere copy or unmanaged information; verification typically confirms that the content and structure of a record remain unchanged across its lifecycle and through processing, storage, and transfer. Integrity verification is generally distinct from access authorization and from validation of the substantive accuracy of the original content, and the specific mechanisms and evidentiary requirements often depend on organizational policy, applicable standards, and jurisdiction. The term is also applied in adjacent domains such as software artifacts and AI models, where it concerns confirming that components have not been compromised, modified, or corrupted.

Why it matters

Integrity is one of the core properties that distinguishes an authoritative record from mere information or an unmanaged copy. A record functions as evidence of an activity or decision, and that evidentiary value depends on being able to demonstrate that the record still reflects its original content and structure. Integrity verification supplies that demonstration by confirming that a record has not been altered, corrupted, or tampered with since its creation, transmission, or storage. Without such assurance, an organization may be unable to rely on a record when it matters most, such as during litigation, audit, regulatory inquiry, or a freedom of information response.

It is important to be clear about what integrity verification does and does not establish. Confirming that a record is unchanged since capture says nothing about whether the original content was accurate, complete, or created by an authorized person. In this sense integrity verification supports, but does not replace, the related properties of authenticity, reliability, and usability that together characterize a trustworthy record. It is also distinct from access authorization; a record can retain its integrity while access controls determine who may view or handle it. Professionals should treat these as complementary controls rather than substitutes.

The concept extends beyond conventional records into adjacent domains. As organizations increasingly rely on software artifacts and AI models, integrity verification is applied to confirm that these components have not been compromised, modified, or corrupted. The specific mechanisms used and the level of assurance required generally depend on organizational policy, applicable standards, and the relevant jurisdiction and sector, so there is no single universal approach.

Who it's relevant to

Records managers
Those responsible for maintaining records as trustworthy evidence rely on integrity verification to demonstrate that records remain unchanged across their lifecycle, including through storage and transfer. It underpins the integrity property that, alongside authenticity, reliability, and usability, distinguishes an authoritative record from a copy or unmanaged information.
Information governance officers
Integrity verification is one control within a broader accountability framework covering policy, risk, privacy, and security. Governance leads are typically concerned with how it fits alongside access authorization and other controls, and with setting policy on the mechanisms and assurance levels appropriate to the organization's risk profile and applicable requirements.
Compliance and legal teams
When records are used as evidence in litigation, audit, or regulatory inquiry, the ability to show that a record has not been altered can be significant. Because evidentiary requirements often depend on jurisdiction and sector, these teams generally define what level of integrity assurance is needed and how it should be documented.
Archivists
Those managing records over the long term, including through disposition actions such as transfer and permanent preservation, use integrity verification to confirm that content and structure are preserved through processing, storage, and migration, so that records remain usable and trustworthy over time.
Security and IT practitioners
Practitioners implementing the technical mechanisms behind integrity verification, including those working with software artifacts and AI models, apply the process to confirm that components have not been compromised, modified, or corrupted. Their work supports but is distinct from validating the substantive accuracy of the underlying content.

Inside Integrity Verification

Integrity Property
The characteristic that a record remains complete and unaltered from the time it was created or captured, other than through authorized and documented changes. Integrity is one of several properties (alongside authenticity, reliability, and usability) that distinguish an authoritative record from mere information, and integrity verification is the process of confirming that this property has been maintained.
Verification Methods
Techniques used to detect whether a record has been altered, including cryptographic hashing or checksums, digital signatures, audit trail review, and fixity checks. The appropriate method typically depends on the format, sensitivity, and retention requirements of the records concerned, as well as organizational policy.
Fixity Information
Recorded evidence, such as a hash value or checksum generated at capture, against which a record can later be compared. A mismatch between stored fixity information and a freshly computed value typically indicates that the record has changed, though it may not on its own reveal how or by whom.
Audit Trail and Metadata
Contextual and process metadata documenting the record's history, including who accessed or modified it and when. Audit trails support integrity verification by providing a defensible account of authorized changes and by helping distinguish sanctioned amendments from unauthorized alteration.
Chain of Custody
The documented, unbroken record of a record's handling, transfer, and storage over time. Maintaining chain of custody supports integrity claims by evidencing that a record was protected against undetected alteration throughout its lifecycle, including during transfer or migration.
Scope Boundary
Integrity verification confirms that a record has not been improperly altered; it does not by itself establish authenticity (that the record is what it purports to be), reliability (that its content can be trusted as an accurate account), or usability (that it can be located and rendered). These properties are related but distinct and typically require separate controls.

Common questions

Answers to the questions practitioners most commonly ask about Integrity Verification.

Does integrity verification prove that a record is authentic?
No. Integrity verification and authentication address related but distinct properties. Integrity verification confirms that a record has not been altered or corrupted since a defined point, typically its capture into a recordkeeping system. It does not, on its own, establish authenticity, which concerns whether a record is what it purports to be and was created or sent by the person or process claimed. A record may be verifiably unaltered yet still be of uncertain provenance. In practice, authenticity is supported by a combination of controls, including metadata about origin, chain of custody, and access controls, alongside integrity verification. Treating an unbroken integrity check as sufficient proof of authenticity overstates what the technique demonstrates.
Is integrity verification the same as making a backup of a record?
No. These serve different purposes and should not be conflated. A backup produces a copy that supports recovery if the primary record is lost or damaged, but the existence of a backup does not by itself demonstrate that any given copy remains unaltered. Integrity verification is the process of checking that a record's content and, where relevant, its structure and metadata have not changed since a reference point, often by comparing computed values against previously recorded ones. Backups and integrity verification are frequently used together, since a backup is more trustworthy when its integrity can also be verified, but one does not substitute for the other.
At what points in the record lifecycle should integrity be verified?
Organizations often verify integrity at several points rather than once. Common points include the moment of capture into a recordkeeping system, so that a baseline reference is established, and on transfer between systems, storage media, or custodians, where alteration or corruption risk is elevated. Periodic checks during retention are also common, particularly for records held over long periods where media degradation or migration may occur. Verification is typically also relevant at the point of disposition, including transfer to an archive or approved destruction, to confirm that the record acted upon is the intended one. The specific schedule depends on organizational policy, the value and sensitivity of the records, and applicable requirements, which vary by jurisdiction and sector.
How can integrity verification be built into records management processes?
Integrity verification is generally implemented as a combination of technical and procedural controls rather than a single tool. Technical measures often include computing and storing reference values at capture, recording them in protected metadata, and re-computing them at defined checkpoints to detect change. Procedural measures typically include documenting when and how checks are performed, defining who is accountable, and specifying the response when a check fails. Embedding these steps into existing capture, transfer, and disposition workflows, rather than treating verification as an occasional manual task, tends to make the controls more consistent and defensible. The appropriate approach depends on the systems in use and organizational policy.
What should happen when an integrity check fails?
A defined response procedure is generally advisable so that failures are handled consistently rather than case by case. Typical steps include isolating the affected record to prevent further change, investigating the cause to distinguish accidental corruption from unauthorized alteration, and consulting any available backups or prior verified versions to determine whether an unaltered instance exists. Documenting the failure, the investigation, and the outcome supports accountability and may be important where the record has evidential value. Because a failed check can have legal, regulatory, or evidentiary implications that differ by jurisdiction and sector, escalation paths and, where relevant, notification obligations should be defined in policy in advance.
How does integrity verification support long-term or permanent preservation?
For records retained over long periods, including those designated for permanent preservation, integrity verification helps address the risk that content, structure, or metadata may change over time through media degradation, format migration, or system change. Repeated verification against reference values can detect such change and trigger remediation from a verified source. It is worth noting that verification confirms whether change has occurred; it does not by itself prevent degradation or preserve usability, which depend on additional preservation activities such as managed storage, migration planning, and format management. The intensity and frequency of verification typically reflect the record's assessed value and any applicable preservation requirements, which vary by organization and jurisdiction.

Common misconceptions

Integrity verification proves a record is authentic and trustworthy.
Verification of integrity confirms only that a record has not been altered since a reference point; it does not establish that the record is genuinely what it claims to be or that its content is reliable. Authenticity and reliability are distinct properties that depend on additional evidence such as provenance, capture context, and metadata.
A verified integrity check means the record's content is accurate or correct.
Integrity concerns completeness and freedom from unauthorized change, not the correctness of the information itself. A record can retain full integrity while containing errors present at creation. Integrity verification detects alteration, not factual accuracy.
Once fixity information is generated at capture, integrity is guaranteed for the record's whole lifecycle.
A single check at capture is a starting point, not a guarantee. Integrity can be affected during storage, migration, or transfer, so verification typically needs to be repeated at appropriate intervals and at key lifecycle events, with any authorized changes documented.

Best practices

Generate fixity information such as hash values or checksums at the point of capture and store it separately from the record so that later comparisons remain meaningful.
Repeat integrity checks periodically and at key lifecycle events, particularly before and after transfer, migration, or format conversion, and retain evidence of each check.
Maintain complete audit trails and process metadata so that authorized changes can be distinguished from unauthorized alteration and any integrity failure can be investigated.
Document chain of custody across all handling, storage, and transfer so integrity claims remain defensible over time.
Select verification methods proportionate to the sensitivity, format, and retention requirements of the records, in line with organizational policy and any applicable jurisdictional or sector obligations.
Treat integrity verification as one control among several, complementing it with measures that address authenticity, reliability, and usability rather than relying on integrity checks alone.