Keeping an audit trail that holds up

Most compliance problems are not caused by a missing assessment. They are caused by a record that cannot prove when it was made, who made it, or what it said at the time. When that proof is thin, a sound piece of work can still fail under scrutiny. Here is how we think about keeping a trail that holds up.

Capture at the time, not after

A risk assessment written from memory a fortnight later is weaker than one captured on site, even if the conclusions are identical. Record findings as you make them, date them, and attach the evidence while it is in front of you. The closer the record sits to the moment of inspection, the harder it is to challenge.

Lock the record once it is approved

A record that can be edited after sign-off is a record that invites questions. Once an assessment or audit is approved, it should be frozen. If something changes, the right answer is a new dated record, not a quiet edit to the old one. A clear sequence of point-in-time documents tells a far stronger story than a single file that keeps moving.

Keep responsibility visible

Every record should show who owned it and who signed it off. When responsibility is named, gaps are easier to spot and easier to close. When it is implied, the gap is usually found by whoever is auditing you.

Make the trail easy to follow

A defensible trail is one a stranger can read in order. Dates, owners, approvals, and supporting evidence should sit together, not scattered across inboxes and shared drives. If you can hand someone the history of a building and they can follow it without a guided tour, you are in good shape.

SAMRISK is built around these habits. Assessments are dated and owned, audits freeze on sign-off, and the history of each building stays in one place. You can see how the pieces fit on the risk assessments and audits pages.