One of your restaurant customers has sent you a Certified Analysis & Audit Report identifying discrepancies in what they were billed. This page explains what that document is, how it was produced, how to check it yourself, and what a useful response looks like. It is written for the person who has to evaluate the claim — a billing analyst, an account manager, a controller, or counsel. It is not a sales page.
A CAAR is a reconciliation report. It compares what you billed a customer against the customer's own transaction records and the rate schedule in the agreement you both signed. Where those three sources disagree, the report says so, states the amount, and cites the specific records the finding rests on. It was produced by FohBoh | Sentry™, an independent certification service — nobody at the operator's business calculated the figures, and nobody at FohBoh negotiated them. The report is the output of a fixed rule set applied to sealed data. A spreadsheet from a customer invites a conversation about methodology; a CAAR is designed to make the methodology the least interesting part of the conversation, so the two of you can talk about the money.
The figures are not anyone's judgment: a fixed, versioned rule set runs on sealed evidence, and the same evidence, rule version and configuration always give the same result, which your team can reproduce from the evidence pack.
The engine has no model, no inference, no sampling, no extrapolation and no estimation in the variance calculations. Given the same inputs and the same rule version, it returns the same result — the same figures, and the same hash. That property makes the report reproducible rather than merely plausible. Where a report states a count — thirty-four batches, four hundred and seventeen pickup orders — every one is identified in the evidence manifest.
A practical note: the certified recoverable amount on the cover is a calculation under the stated rules and evidence. It is not an invoice, and it is not an assertion that a court has decided anything. It is the number the record supports.
Every certification produces a Trust Score from 0 to 100 across 11 Trust Gates. It measures the evidence: how complete, timely and consistent it was, not confidence in the conclusion or the size of the findings. The outcome is printed on the CAAR's cover.
The evidence is complete enough to stand behind the figures.
Strong evidence, with the remaining gaps named.
Something essential is missing, so the money is not certified yet.
The evidence cannot support certification.
Read the outcome before the amount. The operator receives a CAAR for every certification, whatever the outcome. A CERTIFIED CAAR stands behind its figures; any other outcome tells you, by name, what the evidence does not yet support.
A CAAR is sealed the moment it is generated: its SHA-256 fingerprint is computed over the sealed record, which is signed and written to an append-only vault under retention controls. From that point it cannot be edited — not by the operator, not by their accountant, not by FohBoh. The same applies to the source evidence, hashed at receipt before any rule ran. Two things follow, and they cut in both directions:
Practical consequence: keep the CAAR as received and quote its identifier. The verify check runs against the sealed record itself, so any copy can be checked against the original.
You do not need an account or anything from the operator to check the seal. Each CAAR carries its sealed record's identifier and SHA-256 fingerprint, and anyone can check them through the public verify link on the report. The check confirms the record is exactly as sealed and reveals nothing else about the operator.
A valid result means the record is exactly as sealed. It does not, on its own, mean you agree with the findings — that is section 10 — but it removes one whole category of argument from the table, which is usually in everyone's interest.
Not because anyone wants a courtroom: the way this document is built determines how much of a conversation is left to have, and it is worth knowing what your counsel will see when you forward it.
The evidence pack below makes the underlying records available to you in advance. None of this decides whether anything is owed, and FohBoh makes no claim about admissibility, which is for counsel and the forum to judge; it means the argument, if there is one, will be about the numbers and the contract rather than about whether the document says what it says.
Alongside the CAAR, the operator can provide the complete evidence pack: every source record the reconciliation relied on, sealed, with the manifest tying each one to the findings it supports — including your own settlement and statement files exactly as you issued them. The pack exists so your team can reproduce the calculation independently. If your figure differs, working through the pack will show where the two diverge — a different denominator, a different effective date, a rate table never loaded, an amendment never provided. That is where most disagreements actually live. If you received the CAAR but not the pack, ask the operator for it.
Findings are numbered. A response that addresses finding 4 specifically moves things forward; one that addresses "the claim" does not.
An amended addendum or countersigned tier change resolves a finding immediately — and if it was never provided to the operator, it could not have been loaded.
Give the transaction, batch or order identifiers. The manifest makes them directly comparable.
Partial resolution is normal. Separating agreed items from disputed ones shrinks the conversation quickly.
A general denial, a restatement of policy, or a referral to a self-service portal will not close a certified claim — and it is itself preserved in the claim file. Operators track rejections; a third one typically moves the matter to outside counsel with the sealed pack attached, a worse outcome for both sides than a substantive reply now.
Notice what is not on that list: whether the numbers were assembled honestly, whether the evidence was selected to suit the conclusion, and whether the document was altered since issue. Those are the arguments the seal and pre-analysis hashing are designed to retire.
The amount, the credit, the timing — go to the operator. It is their claim; FohBoh will not discuss it on their behalf or intervene in it.
How a rule works, what a Trust Score band means, how to verify a seal — michael@fohboh.com. We answer for either party, because a methodology only one side understands is not much of a standard. See the example report before yours arrives.