Regulated agriculture has this exactly backwards. We’ve built an entire compliance economy around the event — the annual PQA Plus site assessment, the packer’s yearly welfare audit, the FSIS label review, the once-a-year binder inspection. The record that all of these events sample is treated as an afterthought: a spreadsheet, a drawer of paper VFDs, a folder of PDFs named scan_final_v2.
That’s not a knock on producers. It’s how the tooling was built. But it’s why the whole system is fragile in a way nobody likes to say out loud.
The audit is a snapshot. The risk lives between snapshots.
A periodic audit certifies a moment. It says: on the day we looked, the records were in order. What it cannot say anything about is the 364 days it didn’t look.
This isn’t a hypothetical gap. When FSIS and USDA-ARS ran a broad residue screen on animals sold into “Raised Without Antibiotics” markets, roughly one in five samples came back with antibiotic residues. Every one of those animals came from an operation that had, at some point, passed an audit. The audit wasn’t lying. It just wasn’t there on the day the record went wrong.
The lesson the market is slowly absorbing: a claim is only as good as the record underneath it, continuously — not as good as the last time someone audited it.
A record’s worth is what it costs an adversary to discredit it.
Here’s the reframe I keep coming back to. There is a difference between having records and having evidence, and the difference is measured by what it costs someone to knock your record over.
A spreadsheet dies to a single sentence: “Anyone could have edited this.” It doesn’t matter that you didn’t. The moment a packer’s QA lead, a program auditor, or — worst case — a plaintiff’s lawyer says that sentence, the burden flips to you, and you’re reconstructing intent from memory.
A record that is chained — where each entry is cryptographically bound to the one before it, and where the database itself refuses to let history be rewritten — makes that sentence boring. “Anyone could have edited this” gets the answer “no, and here’s the math.” The question doesn’t go away because you’re a nice person. It goes away because it’s been engineered out.
That property — ungameable by construction — is not a feature you bolt onto an audit. It’s a property of the record layer, and it only exists if the record layer was built for it from the start.
Why this is the moat, and the audit isn’t
Audits are a service. Services are competed on price and relationships, and the incumbents who run them — the third-party verifiers with the recognized seals — already own those relationships. That’s not a fight worth picking.
The record layer underneath the audit is a different animal. Once a producer’s renewal calendar, treatment history, movement records, and claim determinations live in one system — and once that system is the thing their vet works in and their packer relies on — switching means re-onboarding years of obligations, history, and muscle memory. That’s the lock-in the SaaS era actually rewarded. Avalara didn’t win tax by running audits; it won by being the record of what you owe. Plaid didn’t win by aggregating data; it won by being the wiring everyone else’s product ran through.
The agricultural version of that is not a better audit. It’s being the system of record the audit feeds from — the continuous, tamper-evident layer that makes any auditor’s job trivial and closes the between-audit gap that periodic review structurally can’t see.
What this means if you’re evaluating tooling
Ask a vendor one question: when did this record last change, who changed it, and could that history be rewritten without anyone knowing?
If the honest answer is “it’s a spreadsheet, so — yes, silently,” you don’t have evidence. You have a very organized liability.
The move is not to buy a better audit. It’s to make the record itself the thing that can’t be gamed — so the audit becomes a formality and the claim becomes something you can actually stand behind, on the day it matters, without scrambling.
The audit checks the record. Build the record that doesn’t need the check.