Skip to content
Product, Privacy & Process

The attachment is not a longer CV

Where an application asks you to upload supporting evidence, that upload is governed by instructions your CV never is — how much to include, what has to be removed first, which format, and whose information you are responsible for. One UK recruitment process states all four in writing, and the first is the opposite of how a CV works.

11 min read·Published 2 Oct 2026·Europass CV Maker · Editorial policy

Most advice about job applications treats everything you send as one undifferentiated pile of paperwork. It is not. A CV and a pack of uploaded supporting evidence are two different kinds of document with two different jobs, and in at least one respect their instructions point in opposite directions.

A CV persuades. Within a length convention, more relevant evidence on it is better than less, and the whole craft of writing one is deciding what earns its space. An evidence pack does not persuade anybody. It exists so that a claim you have already made can be verified by somebody who has very little time, and the published guidance for it says, in so many words, to upload less.

The example used throughout here is UK medical specialty recruitment, because it is one of the few selection processes that publishes its evidence rules in detail rather than leaving applicants to infer them. The rules quoted are that process’s rules, and this article does not claim any other employer imposes them. What does generalise is the shape of the problem, and the fact that nobody is going to ask you twice.

Two documents, two opposite instructions

NHS England’s guidance on specialty training interviews and selection sets out what to upload against a scored self-assessment, and the instruction is restrictive rather than encouraging. "Only evidence supporting each of the claimed achievements should be uploaded. There is no requirement to upload any additional documents or achievements if they are not directly related to the scoring domain where points are being claimed". And again, in case the first reading was too generous: "Only sufficient evidence should be provided to justify the scores awarded." Checked 2026-10-02.

The worked examples on that page are more instructive than the rule. "For example, if you have completed a national presentation, you should not include evidence for other presentations. If you have written a book, you do not need to upload the whole book, just sufficient pages so interviewers can verify your achievement". Having written a book is the strongest thing in that paragraph, and the instruction is still to send a few pages of it.

The reason is stated too, and it is the sentence worth carrying away: "Panel members will need to verify your evidence in a short time so keep the below in mind when organising your evidence, as poorly organised/presented documents may mean achievements cannot be verified." So the cost of over-supplying is not that somebody is mildly annoyed. It is that a real achievement goes unscored because the document proving it was buried in twelve others.

This is the exact inversion of the instinct a CV trains. On a CV, an achievement you leave out is an achievement nobody knows about. In an evidence pack, an achievement you over-document is an achievement nobody can find.

The attachment is where other people’s information ends up

Here is the part almost no CV advice addresses. Your CV is a document about you. Your evidence pack is usually a copy of real work, and real work contains other people.

The guidance is unambiguous about what that means in a clinical setting. "Information governance regulations state that you must not allow any patient-identifiable data (PID) to be moved away from the designated (usually clinical) area. As such, you must ensure none of the documentation you use at interview (for example, details of case reports and audits) contain information which could be used to identify patients. This would be a breach of patient confidentiality. This includes hospital or NHS ID numbers. All such patient-identifiable data must be redacted." Checked 2026-10-02.

And there is a consequence attached, which is unusual for recruitment guidance and tells you how seriously it is meant: "If patient-identifiable data is found, it is likely that your employer, supervisor and region (as relevant) will be notified, in order to take further action." The failure is not scored down. It is referred onwards, to your current employer.

The specific rule there is clinical and we are not going to pretend it applies to a marketing job. The structural point does travel, because the documents people reach for as evidence are the same everywhere: a client report with the client named in the header, a contract with a counterparty and a price in it, a classroom observation with a pupil’s name on it, a spreadsheet whose other tabs you forgot about, a screenshot with somebody’s inbox visible down the left-hand side. In every one of those, the person whose confidentiality is at stake is not you, which is also why you are the one least likely to notice.

Redaction is not deletion, and a file remembers more than it shows

The common way to redact a document is to draw a black rectangle over the name and save it. In a PDF that usually leaves the text exactly where it was, underneath a shape, fully selectable and fully searchable. The page looks redacted. The file is not.

We have first-party evidence of the general shape of this problem from testing our own PDF export. A CV exported from this site carries its text in two places: in the page content, and in the document’s own metadata, where the candidate’s name is written as the document title. When we built a text extractor to check that our exported CVs are machine-readable, the name came out of the metadata trivially while the body needed the embedded character maps to be decoded properly. The lesson transfers directly: what a PDF displays and what a PDF contains are two different questions, and only one of them is answered by looking at it.

So verify rather than trust. Open the finished file, try to select the text where the redaction is, and search the document for the name, the number or the identifier you removed. Then open the document properties and look at the title, author and subject fields, which are set from whatever produced the file and are frequently a person’s name or a filing reference. Check the file name itself for the same reason — an attachment called audit-smith-j-final.pdf has leaked before it is opened.

Our article on checking whether a CV PDF is actually readable covers the extraction procedure itself and the five ways an export fails. This section is the same technique pointed the other way: there, you want to confirm the text is there; here, you want to confirm it is gone.

The process rules that quietly cost people credit

The rest of the published requirements for that upload are mundane, and every one of them is a way to lose marks for work you genuinely did. They are worth reading as a category rather than as a list, because an equivalent set exists in any portal that accepts attachments and is almost never summarised anywhere.

  • Format and size. "Only PDF and image files can be uploaded to the system" and "The maximum file size is 5MB". A 5MB cap and a scanned certificate are a genuine collision, and compressing an image until the text stops being legible defeats the point of sending it.
  • Language. "Any documentation not in English must be translated for credit to be received." A certificate in another language is not partial credit; untranslated, it is no credit.
  • Placement. "When evidence is loaded, it needs to be attached to the domain(s) to which it pertains", and one document can serve two — the page’s own example is a prize-winning presentation attached under both the presentation and the prize. A file uploaded but attached to nothing is not evidence of anything.
  • Relevance. "Evidence of training courses or areas noted in your commitment to specialty section should not be included unless they specifically relate to a scored option." Material that is genuinely about you and genuinely creditable elsewhere is still wrong here if nothing is being scored for it.
  • Deadline, and who can act. "Recruitment administrators will not be able to upload evidence on your behalf and once the deadline for submission has passed, will be unable to submit evidence." There is no route to a late submission through somebody being helpful.
All of the above is from the same NHS England page, checked 2026-10-02. The point of quoting the boring half is that it is the half people assume they can work out on the night.

What this changes about the CV itself

If a verifier is going to match your claims against documents, then the CV’s job in that kind of application is narrower and more mechanical than usual: every claim should be written so it can be matched to one thing. That is a different test from being impressive, and occasionally it pulls against it.

"Led a quality improvement project" cannot be matched to a document. It names no artefact, so a verifier holding a certificate, a poster and a report has no way to tell which one you meant. "Two-cycle re-audit of venous thromboembolism assessment completion, presented at the departmental governance meeting in March 2025" can be matched in seconds, because it names the output, the forum and the date — three things that appear on the evidence itself.

The same applies to anything with a number attached. A claim and its evidence have to agree, which means the figure on your CV should be the figure on the document, not a rounded or improved version of it. Where a figure is adjusted upward between the report and the application, it is the application that looks wrong.

Weak

Led a successful audit project that improved compliance significantly across the department.

Stronger

Re-audited venous thromboembolism risk assessment completion on a 28-bed ward over two cycles (n=140 and n=132); completion moved from 62% to 88% after a prompt was added to the admission checklist. Presented at the departmental governance meeting, March 2025.

The second version names an artefact a verifier can hold, with figures that will appear on it and a date and forum that can be checked against a meeting record. All demonstration figures here are fictional, and the point is the shape rather than the numbers: the stronger line is not more impressive, it is matchable.

Writing evidence when you have no figures at all is a different problem and we have treated it separately, in our article on what to write when you have no numbers to quantify. This section is only about claims a document is supposed to confirm.

Before you upload anything

  1. Read the scoring domains first and write down which claim each file is for. A file with no claim behind it should not be in the folder.
  2. For each claim, choose the single document that verifies it most directly, and if that document is long, extract only the pages that show the thing.
  3. Remove other people’s identifying information properly — not covered over, removed — and remember that identifiers include reference numbers, not only names.
  4. Reopen the finished file and search it for what you removed. Then check the document properties and the file name for the same information.
  5. Check format, size and language against the instructions, and translate anything that needs it before the deadline rather than on it.
  6. Attach each file to the domain or question it belongs to, and attach one file twice where it genuinely evidences two things.
  7. Keep a copy of exactly what you submitted and when. If a figure or a claim is queried in three months, the version you sent is the only one that matters.
Do this in a folder that is not your working folder. Several of the leaks described above happen because the original document was one click away from the redacted one and the wrong one got attached.

Questions

Does any of this apply outside clinical recruitment?
The rules quoted here belong to one published UK process, and we make no claim that another employer imposes them. Two things do carry over regardless. The first is that supporting evidence is drawn from real work and therefore contains people who are not you, whose information is not yours to circulate. The second is that uploads are usually one-shot and deadline-bound, so a mistake in the pack is not something you get to correct later. If an application you are making has written instructions for its attachments, read them as carefully as you read the person specification.
Would it not be safer to upload everything I have?
In the process described here it is explicitly discouraged, and the stated reason is that a verifier working quickly through a crowded folder may not be able to confirm an achievement at all. Over-supplying also multiplies your exposure: every extra document is another one that might contain somebody else’s details. Fewer, better-chosen files is both the instruction and the lower-risk option.
Is a black box drawn over a name enough to redact a PDF?
Often it is not. Drawing a shape over text in most editors leaves the text in the file, where it stays selectable and searchable. Whatever tool you use, the check is the same and takes a minute: open the saved file, try to select the text under the redaction, and search the document for the name or number you removed. Also look at the document properties, because titles and author fields are filled in automatically and are a separate leak from the page itself.
Should the CV list the evidence I am attaching?
Generally no — a column of file names makes a CV harder to read and the portal already links the two. What the CV should do is describe each claim so that the matching document is obvious: name the output, give the date, and say where it was presented, published or recorded. The test is whether somebody holding your folder could pick the right file without asking you.

Sources

The full guide

This article covers one decision. These cover the whole subject.

Worked examples by role

Put this into practice

The editor keeps your CV as structured content, so the decisions in this article are easy to apply and easy to change again.

Europass CV Maker is an independent CV-building service and is not affiliated with or endorsed by Europass or the European Commission.