Audit-grade computational chemistry: provenance, reproducibility, and trust

Computational predictions increasingly feed decisions that have to survive scrutiny — from internal stage-gates to regulatory review. A number from a script someone ran once, on a laptop, with libraries that have since updated, is not something you want to stake a decision on. 'Audit-grade' is the standard that fixes this, and it is mostly about discipline, not exotic technology.

What 'audit-grade' actually means

• Reproducible — the same input produces the same output, today and in two years.
• Provenanced — every result records exactly how it was made: recipe, code versions, inputs.
• Tamper-evident — the result is signed or hashed, so any change after the fact is detectable.
• Comparable — produced by one fixed recipe, so results sit on the same footing.

Why ordinary computational results fail this bar

The usual failure modes are mundane: an unpinned library version that silently changes the numbers, a hand-edited geometry no one saved, a recipe that drifted between projects, a 'final' spreadsheet with no link back to the calculation that produced it. None of these are bad science in the moment — they are the absence of a system. Audit-grade is that system.

Provenance: the minimum useful record

A provenance record worth the name captures at least:

1. The exact recipe (functional, basis, cavity/radii, solvation, conformer treatment).
2. The input structure and how its 3D geometry was produced.
3. The code and versions, pinned — including the quantum-chemistry libraries.
4. A hash or signature over the output so it is tamper-evident.
5. A timestamp and an identifier linking the result back to all of the above.

Why tamper-evidence matters

Reproducibility says you could regenerate the result. Tamper-evidence says the result in front of you is the one that was generated — that nobody edited a value in a report afterward. A signature over the output closes the gap between 'we computed this' and 'this is what we computed.'

The payoff

Audit-grade results are reusable: a profile computed once can be trusted across projects without recomputation, because its provenance answers every question about how it was made. They are also defensible: when someone asks 'how do you know,' the answer is a record, not a memory.

How mfsig does it

Every reference-grade σ-profile from mfsig.com is generated with a pinned production recipe (v0.91.1), carries a full provenance record, and is signed so it is tamper-evident. The result is a σ-profile you can put in front of a reviewer — not just one you can plot.