---
title: "How to audit proposal citations before submission"
description: "Test every proposal citation from the evaluator’s side: source identity, version, locator, access, permission, support and the final rendered route."
canonical: "https://zephior.com/insights/audit-citations-in-an-rfp-response"
last-updated: 2026-09-04
---

# How to audit proposal citations before submission

> Test every proposal citation from the evaluator’s side: source identity, version, locator, access, permission, support and the final rendered route.

By [Tony Kim](https://zephior.com/authors/tony-kim). Published 2026-09-04; updated 2026-09-04. 20 minute read.

## Definition

A proposal citation audit is an occurrence-level check of every link, footnote, endnote, attachment reference and internal cross-reference in the submission. It ties the exact cited statement to an identified source object and version, records the issuer, title, date and identifier, verifies a precise locator, tests access from the recipient’s position, confirms that external use is permitted, checks that the passage supports the words used, and repeats the test in the rendered file or portal. The result is pass, repair, replace, narrow, remove or block. A working URL, a familiar document title and correct bibliography style do not by themselves prove that an evaluator can reach or use the cited evidence.

## Problem

Fenmarch Water Operations is preparing a response for maintenance of river-pumping telemetry. Its 112-page proposal contains 47 citation occurrences. A method statement says its remote-diagnostics process restored 96 per cent of priority incidents inside four hours and cites “Operational Performance Review, page 18.” The link opens an employee-only SharePoint page. A new cover inserted during PDF production has shifted the visible page to 19, and the cited sentence covers remote triage only, not full service restoration. The underlying customer report may be disclosed only as an anonymized extract. Two hours before the release cutoff, the team must decide what the evaluator can receive, which words the source supports and whether every repeated citation still leads to the same evidence.

## Point of view

Audit a citation as a route from one exact proposal occurrence to one exact passage. Start with the rendered occurrence rather than a master bibliography. Resolve the source object and version, then verify the locator, recipient-equivalent access, disclosure permission and support. Treat redirects, login pages and current-edition landing pages as failures until the intended object is confirmed. Use page numbers together with a section, table, paragraph or short quoted anchor because pagination can move. For controlled evidence, give the evaluator the buyer-permitted attachment or data-room route instead of an internal address. Recheck the exported PDF and portal copy. Repair the citation, narrow the statement or stop release when the route does not survive that test.

## Audit the route from the proposal sentence to the cited passage

A proposal citation passes only when the evaluator can start at the released sentence, identify the intended source, reach it through an allowed route and find a passage that supports the words used. Check that complete route for every occurrence. A polished references page cannot compensate for a footnote that names the wrong report or a hyperlink that works only for an employee.

The unit of work is the citation occurrence. The same report may appear in a technical answer, a benefit table and an executive summary, but each occurrence can contain different wording, a different locator or a different link. Give every occurrence its own row and connect rows that intend to use the same source. This catches repairs that reached one section but not the others.

Keep citation mechanics separate from substantive evidence review without disconnecting them. A claim-to-source scope review checks whether the evidence covers the proposition. This audit asks whether the final citation identifies and delivers that reviewed source and passage. If the citation reveals a deeper scope mismatch, reopen the evidence decision instead of calling it a formatting defect.

Bibliographic style comes last. A consistent comma cannot repair an inaccessible source, an unidentified edition or a passage that proves less than the sentence says.

**Minimum citation audit record**

| Record part | Required content | Pass condition |
| --- | --- | --- |
| Occurrence | Exact statement, response section, note or link text and release version | The dependent words are unambiguous |
| Source | Issuer, title, date, edition, identifier, file identity and source type | One controlled object is identified |
| Locator | Page plus section, table, figure, paragraph, record or quoted anchor | The supporting passage is found directly |
| Route | URL or annex path, access context, expiry, permission and test result | The intended evaluator can open it lawfully |
| Decision | Support state, disposition, owner, test time and reopen trigger | The final wording and citation agree |

## Name the source object precisely enough to distinguish it

Start from the native source, not the copy that happened to reach the writer. Record the issuing body, full title, publication or effective date, edition, report period and a durable identifier such as a report number, legislation citation or DOI where one exists. For an attachment, preserve the controlled filename and file fingerprint. For a web page, record the page title, publisher, URL and access date when the content changes over time.

A source title may still be ambiguous. “Operational Performance Review” could name monthly, regional and customer-specific reports. “ISO 27001” could point to a standard landing page, a certificate or an internal policy. The citation must identify the object that contains the supporting passage. Crossref’s metadata guidance is useful for publications with persistent identifiers, while legislation and procurement sources often have their own versioned identifiers.

Preserve provenance when the cited file is a derivative. If a slide copies a figure from a signed customer report, record the slide as the object the proposal shows and the report as the evidential source. The W3C PROV model offers a useful vocabulary for entity, activity and responsible agent, but this workflow does not claim formal PROV conformance. The practical requirement is simpler: a reviewer must see what was copied, from where, when and by whom.

Dynamic pages require a deliberate choice. Cite the dated version or official archive when the page itself supplies one. If the procurement permits a controlled capture, store it with its observation time and authorization. Never imply that an archive is the current page, and do not create an archive or copy where terms, confidentiality or copyright prohibit it.

## Pair the page number with an anchor that survives production

A page number is helpful only when source and pagination are fixed. Word-to-PDF conversion, a new cover, document merging and redaction can all move visible pages. Pair “page 19” with “section 4.2, Remote triage, table 6, Priority incidents” or a short exact phrase. For a spreadsheet, use workbook, sheet, named range or cell range and the controlled version. For a database extract, identify the record set and query or export rather than inventing page numbers.

Web fragments need inspection. RFC 3986 defines a fragment as identifying a secondary resource, but the meaning depends on the retrieved representation and media type. A fragment that selects a heading in HTML may do nothing after the publisher redesigns the page. Test the final link, preserve a readable textual anchor and avoid promising that a fragment is permanent unless the publisher provides that guarantee.

The W3C Web Annotation model describes text-quote and text-position selectors that can identify a passage. Those concepts are useful when designing an internal audit record: preserve a short quote, surrounding context and position together. Do not expose protected text in a public bibliography, and do not claim conformance simply because the record borrows the selector idea.

Locator quality is measured by findability. Ask a reviewer who did not create the citation to open the named object and locate the support. If they need oral directions, a search through several files or knowledge of an internal nickname, the locator has not passed.

**Locator choices by source type**

| Source type | Primary locator | Second anchor |
| --- | --- | --- |
| Fixed PDF | Printed page and section | Table, figure or short exact phrase |
| Web page | Canonical URL and dated version if supplied | Heading plus short exact phrase |
| Spreadsheet | Workbook version, sheet and range | Row keys, headers and calculation name |
| Proposal annex | Annex identifier and controlled filename | Section, exhibit or numbered item |
| Portal record | Procedure and record identifier | Screen or field label plus observed time |

## Test access without the author’s privileges

Open each route in a clean context that approximates the evaluator’s position. Remove the employee session, corporate network, cached authorization and local file access. Check where redirects end, whether a subscription or registration is required, whether a signed URL expires, whether the attachment exists in the submitted package and whether the file opens with ordinary approved software. Record the test identity, time and result.

An HTTP 200 response proves only that a server returned a successful response to that request. RFC 9110 defines the status semantics; it does not certify that the returned representation is the cited report or that the evaluator may access it. A login screen, generic homepage or current-edition page can all return successfully while the citation fails.

Write link text that names the destination. W3C guidance for link purpose says users should be able to determine a link’s purpose from its text or programmatically determined context. “See evidence” repeated 20 times is poor navigation in a proposal and particularly weak for a reader using a link list. Use the document or annex name and, where useful, the relevant section.

PDF links need a second check after conversion. W3C technique PDF11 describes creating recognizable links and link text in the authoring source before conversion. It is an accessibility technique, not a complete citation standard. Use it for the link layer, then still test identity, destination, permission and support.

**Access test outcomes**

| Observed result | Audit state | Required response |
| --- | --- | --- |
| Intended object opens for recipient-equivalent user | Access passed | Continue to permission and support |
| Login, subscription or employee network required | Access failed | Provide an allowed package route or replace the citation |
| Redirect reaches another object or edition | Identity unresolved | Resolve and cite the intended version |
| Signed or shared link expires before evaluation | Access unstable | Use a durable buyer-permitted route |
| File is present but will not open | Delivery failed | Repair format or package before release |

## A source can be accessible and still be unsuitable for disclosure

Access and permission answer different questions. An employee may open a customer report without having authority to give it to a buyer. A public standards catalogue may identify a standard while the full text remains licensed. A data-room reviewer may inspect an exhibit under agreed restrictions without permission to reproduce it inside the proposal. Record who owns the material, the allowed audience, the permitted extract, required redaction and approved route.

Article 21 of Directive 2014/24/EU protects confidential information designated by economic operators, subject to applicable law and procurement provisions. UK, German and French procurement rules also contain confidentiality controls in their own contexts. These rules do not grant a bidder permission over customer or licensed material. The supplier must follow the source owner’s authorization and the buyer’s submission instructions.

For controlled evidence, cite the version the evaluator can lawfully receive. That may be “Annex E-07, anonymized performance extract, section 2” rather than an internal SharePoint address or the unredacted customer report. Keep the internal lineage in the audit record, but do not place confidential paths, names or unnecessary source text in the released citation.

If permission cannot be established, replace the source, seek a cleared extract, change the wording or remove the statement. A disclaimer beside an unauthorized link does not cure the disclosure problem.

## Read the cited passage against every part of the proposition

Open the source at the recorded locator and compare it with the complete proposal sentence. Mark actor, action, object, population, period, result, condition and qualification. A source that says 96 per cent of priority incidents received remote triage within four hours does not support “96 per cent were restored within four hours.” The number and timeframe match; the measured event does not.

Do not stop when a source contains the same keywords. Read definitions, footnotes, exclusions and table denominators. Check whether the passage reports observed performance, a target, a customer quotation, an estimate or a future commitment. If it supports only part of the sentence, identify that part and route the larger scope question back to the evidence review.

Public procurement rules make the consequence context-specific. The UK Procurement Act requires assessment against the published award criteria and conditions. EU and international procurement materials set their own rules for tenders, qualification evidence and evaluation. This guide does not determine legal admissibility or whether a buyer may seek clarification. Follow the live procurement documents and obtain qualified advice for the jurisdiction.

Use four support states: direct, partial, contrary and unknown. “Topic related” is not a pass state. Record the decisive passage and the reviewer’s reason, then connect the approved wording to that decision.

**Citation dispositions before release**

| Finding | Disposition | Release condition |
| --- | --- | --- |
| Identity, locator, access, permission and support pass | Keep | Retest final rendering and upload |
| Correct source, faulty route or locator | Repair citation | Independent reviewer finds the passage |
| Passage supports a narrower proposition | Narrow wording | Every occurrence uses the approved scope |
| Source cannot be disclosed | Replace or use controlled extract | Owner and buyer route are approved |
| No permitted supporting route exists | Remove or block | Statement cannot remain in release set |

## Run the audit again on what will actually be submitted

Freeze the release candidate before the final pass. Export it with the production settings, merge the planned annexes, apply approved redactions and upload the files to the submission draft where the portal permits a reversible check. Download the uploaded package. This is the object to test, not the editable source document.

Follow every live link. Check footnote numbers, endnote targets, bookmarks, table references, annex identifiers and filenames. Search for the old title and locator after a repair. Compare repeated citations to the approved source version. A global search helps find candidates, but a reviewer still needs to inspect the surrounding sentence because identical note text can support different propositions.

European Commission eSubmission guidance tells users to review submission data and attachments and provides a submission report before the final act. Portal behavior varies by procedure, and no draft check equals submission. Preserve the buyer’s required filename, format and upload slot, and keep the citation audit separate from the authorization to submit.

Set reopen triggers. Reaudit an occurrence if the sentence, source version, redaction, attachment order, filename, pagination, portal route or access permission changes. Record the final test time and package fingerprint so the release owner can tell whether the audited object is still the object awaiting submission.

## Fenmarch turns an internal link into a usable evidence route

Fenmarch’s inventory finds 47 citation occurrences connected to 31 source objects. Six occurrences use vague “see evidence” link text. Three links require an employee session. The remote-diagnostics claim appears in the method statement, a performance table and the executive summary. All three point to the same SharePoint page, but only the method statement names a page.

The reviewer resolves the native object as “Customer Operations Review, telemetry region C, final v3.2, reporting year 2025.” Section 4.2 and table 6 report remote triage inside four hours for 96 per cent of 224 priority incidents. Restoration time appears in a different table and has a lower result. The original proposal wording therefore fails on the measured action, even before access is considered.

The customer authorization permits an anonymized extract containing table 6 and its definitions. Fenmarch creates controlled Annex E-07 under that authorization, records its file identity, and cites “Annex E-07, Customer Operations Review extract, section 2, table 6, Remote triage of priority incidents.” The approved sentence now says that remote triage began inside four hours for 96 per cent of the stated incident population. It makes no restoration claim and does not name the customer.

After the annex is merged, the visible extract moves from page 18 to page 19. The section and table anchor remain correct. A reviewer using a clean device opens the downloaded submission package, follows all three references and finds the same passage. Fenmarch also replaces the six vague link labels. The register closes 43 occurrences, records three repaired occurrences and removes one duplicate note. Any later change to the percentage, population, annex or permission reopens those rows.

## Useful outcomes

- Every citation occurrence has a stable identifier and an exact response location.
- The cited source is identified by issuer, title, version or date and a durable identifier where one exists.
- Each locator leads to the passage, table, figure or record that does the evidential work.
- Access is tested from the evaluator’s likely account, network and submission package rather than the author’s session.
- Confidential, licensed and customer material is cited only through an approved disclosure route.
- The cited passage supports the statement at its released scope and does not merely discuss the same topic.
- Links, bookmarks, page references and attachment names are retested after rendering and upload.
- Failed citations produce a named repair, narrower wording, replacement, removal or release block.

## Workflow

1. **Inventory citation occurrences.** Capture every link, note, annex reference and cross-reference with its exact claim, location and response version.
2. **Resolve the source object.** Record issuer, full title, date, edition, identifier, file identity and any relationship to a derivative copy.
3. **Verify the locator.** Open the exact page, section, table, figure, paragraph or record and preserve a second anchor that survives repagination.
4. **Test recipient access.** Use a clean, buyer-equivalent context to test redirects, authentication, expiry, attachment availability and file opening.
5. **Check permission.** Confirm that the source, extract, customer identity and delivery route may be disclosed for this procurement.
6. **Read for support.** Compare the cited passage with the complete proposition, including actor, action, population, period, result and qualifications.
7. **Repair or dispose.** Correct identity, locator or route; substitute approved evidence; narrow or remove the statement; or block release.
8. **Retest the final package.** Open the exported and uploaded version, follow every live route and reconcile notes, annex names and portal fields.

## Key decisions

- Which exact proposal words rely on this citation occurrence?
- What native source object, issuer and version does the citation intend to identify?
- Has a landing page or derivative copy been mistaken for the source itself?
- Which locator lets an evaluator find the supporting passage without guessing?
- Does the route work without the author’s login, network, cookies or expiring token?
- Does the team have permission to disclose the source, customer identity and cited extract?
- Does the passage support the whole released proposition or only a narrower fact?
- Will conversion, merging, redaction or upload change the locator or link behavior?
- What correction is required when identity, access, permission or support fails?
- Which later change to the claim, source, package or portal must reopen the audit?

## Risks

- Counting an HTTP success response even though a redirect ends at a homepage, login or newer edition
- Citing a filename shared by several different documents without an issuer, version or identifier
- Using a page number that moved when a cover, appendix or redaction was inserted
- Linking to an internal drive, local path, author session or short-lived signed address
- Assuming permission to read customer evidence includes permission to disclose or identify it
- Citing a summary that repeats a statistic instead of the record that establishes it
- Allowing a source about remote triage to support wording about complete restoration
- Repairing one footnote while the same broken citation remains in a table or executive summary
- Testing the editable document but not the merged PDF or portal download
- Optimizing punctuation and bibliography style while identity, access or support remains unresolved

## Metrics

- Citation occurrences inventoried against total occurrences in the release candidate
- Occurrences with complete source identity, version and durable identifier
- Occurrences with a verified primary and secondary locator
- Routes opened successfully in a recipient-equivalent access test
- Controlled sources with recorded disclosure permission and approved delivery route
- Citations repaired, replaced, narrowed, removed or blocked by failure class
- Defects introduced by PDF conversion, document merging, redaction or portal upload
- Repeated citations reconciled to the same approved source version
- Post-submission questions caused by inaccessible, ambiguous or overstated citations

## Frequently asked questions

### Is a successful link checker enough for a proposal citation?

No. It may prove that a server responded, but not that the response is the intended version, that the evaluator can access it or that the passage supports the statement.

### Do we need a citation for every proposal sentence?

No universal rule applies. Decide which claims require support under the buyer’s instructions and your evidence policy. This audit checks the citations you use; claim-coverage review is a separate task.

### Can we cite an internal SharePoint or file-system link?

Not as the evaluator’s route unless the buyer has authorized access to that controlled location. Provide an approved attachment or data-room path and retain the internal lineage only in the audit record.

### How should we cite a page that changes over time?

Identify the publisher, title, URL, observed date and supplied version. Use an official dated version or a permitted controlled capture when needed, and state which state was reviewed.

### Is a page number a sufficient locator?

Use it for a fixed file, but pair it with a section, table, figure, paragraph or short exact phrase. Then retest after conversion, merging and redaction.

### How do we cite confidential customer evidence?

Follow the owner’s permission and the buyer’s allowed route. Cite a cleared redacted extract or controlled exhibit precisely, and omit internal paths and identities that are not authorized for release.

### Should citation style be reviewed?

Yes, after identity, version, locator, access, permission and support pass. Apply the buyer’s format where one is specified, but do not let punctuation hide a failed evidence route.

### What can software check in a citation audit?

Software can inventory links and notes, resolve responses and redirects, compare filenames, detect repeated locators and retest a rendered package. People must decide source identity, meaning, permission, support and release.


## Primary sources

- [Procurement Act 2023, section 19 on award criteria and assessment methodology](https://www.legislation.gov.uk/ukpga/2023/54/section/19), UK Legislation
- [Procurement Act 2023, section 30 on incomplete, inaccurate or misleading information](https://www.legislation.gov.uk/ukpga/2023/54/section/30), UK Legislation
- [Official information and guidance collection for suppliers](https://www.gov.uk/government/collections/information-and-guidance-for-suppliers), Cabinet Office
- [The Sourcing Playbook on evidence-led commercial delivery](https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks/the-sourcing-playbook-html), Cabinet Office and Government Commercial Function
- [Guidance for publishing accessible documents](https://www.gov.uk/guidance/publishing-accessible-documents), Government Digital Service
- [GOV.UK guidance for specific, descriptive and maintained links](https://guidance.publishing.service.gov.uk/writing-to-gov-uk-standards/writing-guidelines/add-links/), Government Digital Service
- [UK Government Web Archive guidance for linking to dated archived content](https://www.nationalarchives.gov.uk/webarchive/archive-a-website/how-to-link-to-an-archived-website/), The National Archives
- [Directive 2014/24/EU, including confidentiality and supporting evidence](https://eur-lex.europa.eu/eli/dir/2014/24/2024-01-01/eng), EUR-Lex
- [European Commission quick guide for procurement eSubmission](https://ec.europa.eu/info/funding-tenders/opportunities/docs/esubmission/quickguidepp_en.pdf), European Commission
- [European Commission guide to open-procedure eSubmission](https://wikis.ec.europa.eu/spaces/FTPortal/pages/44144569/Open%2Bprocedures_EN?src=contextnavpagetreemode), European Commission
- [World Bank Procurement Regulations for IPF Borrowers, seventh edition](https://thedocs.worldbank.org/en/doc/c84273d1b230aeb2b0b8134de5dc8cd7-0290012025/original/Procurement-Regulations-7th-Edition-Sep-2025.pdf), World Bank
- [UNCITRAL Model Law on Public Procurement](https://uncitral.un.org/sites/default/files/media-documents/uncitral/en/2011-model-law-on-public-procurement-e.pdf), United Nations Commission on International Trade Law
- [WCAG 2.2 link-purpose guidance](https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html), World Wide Web Consortium
- [W3C PDF11 technique for recognized links and link text in PDF](https://www.w3.org/WAI/WCAG22/Techniques/pdf/PDF11.html), World Wide Web Consortium
- [W3C Web Annotation Data Model for identifying source segments](https://www.w3.org/TR/annotation-model/), World Wide Web Consortium
- [W3C PROV data model for entities, activities and agents](https://www.w3.org/TR/prov-dm/), World Wide Web Consortium
- [RFC 3986 on URI syntax and fragment identifiers](https://www.rfc-editor.org/rfc/rfc3986.html), RFC Editor
- [RFC 9110 on HTTP semantics, status codes and redirection](https://www.rfc-editor.org/rfc/rfc9110.html), RFC Editor
- [Crossref guidance for retrieving publication metadata](https://www.crossref.org/documentation/retrieve-metadata/), Crossref
- [Crossref guidance for citing the correct publication level and DOI](https://www.crossref.org/documentation/principles-practices/books-and-chapters/), Crossref


## Related articles

- [Answer provenance: traceable sources for proposal content](https://zephior.com/glossary/answer-provenance)
- [How to close evidence gaps before proposal approval](https://zephior.com/insights/close-evidence-gaps-before-proposal-release)
- [How to build a pass-fail check before submission](https://zephior.com/insights/build-a-pass-fail-submission-check)
- [How to close unresolved tender questions before approval](https://zephior.com/insights/close-unresolved-tender-questions-before-release)