If you encounter data being falsified, which action follows policy and preserves evidence?

• A. Report to supervisor following policy; preserve evidence.
• B. Publicly announce the falsification to a meeting.
• C. Delete the data to avoid trouble.
• D. Confront the colleague in private with no documentation.

Answer: (A)

When data integrity is compromised, the correct approach is to follow the established policy and preserve evidence. Reporting to a supervisor through the proper channels creates an official record and starts the appropriate investigation, ensuring accountability and consistency with organizational rules. Preserving evidence means not altering, deleting, or discarding data, and safeguarding all relevant materials—the raw data, logs, backups, and any metadata—so the original information remains verifiable and can be analyzed later. Public announcements or private confrontations lack formal documentation and can spread rumors or escalate conflict, while deleting data is a form of tampering that destroys the evidence needed to understand what happened. By following the policy and keeping evidence intact, you enable a fair, traceable resolution.