Almost every funder collects conflict declarations. The form goes out before the panel meets, it comes back signed, and it is filed. When the auditor arrives, the funder can produce the forms. What the funder usually cannot produce is evidence that the declaration did anything.
That gap is the whole finding. A declaration is a disclosure; probity requires a control. The test is not “did the assessor tell you”. It is "what stopped them assessing it anyway", and a signed PDF in a folder does not answer that question.
The three levels
In practice, funders run one of three models, and they are not equivalent even though they all produce paperwork.
- Declared and filed. The assessor tells you, and a person is trusted to act on it. This is the most common model and the weakest, because the control is someone remembering.
- Declared and flagged. The system shows a warning next to the application. The assessor can still open it, read it and score it. The warning is evidence the risk was known and not mitigated, which is arguably worse than not knowing.
- Declared and enforced. The declaration removes access. The assessor does not see a warning because the assessor does not see the application at all, and the removal is itself a timestamped event on the record.
A warning next to an application is evidence the risk was known and not mitigated.
Declare per round, not per year
An annual declaration is a statement about a person. A per-round declaration is a statement about a decision, and only the second one is useful. Relationships change, applicant pools change, and an assessor who had no conflict in March may have a direct one in September. Where declarations are annual, the record cannot show what was true at the moment of assessment.
This is more work to collect, which is why it is usually not done, and it is nearly free once collection happens inside the assessment workflow rather than beside it.
Institutional conflicts are the ones that get missed
Individual conflicts are obvious: the assessor knows the applicant. Institutional conflicts are harder and more common in small sectors: the assessor works at the organisation applying, sits on its board, or is employed by its parent body. A conflict rule set at the organisation level rather than the application level catches all of these at once, including the applications nobody thought to check.
What to keep
Keep the declaration, the rule that was in force when it was made, the access change it produced, and the timestamp on each. That set answers the auditor’s real question (not “did you know” but “what did knowing change”), and it is the difference between a finding and a paragraph.