Why an audit is only as good as its sign-off

An audit is a set of observations until someone puts their name to it. Until that moment it is a draft: useful, perhaps detailed, but provisional, editable and unowned. The sign-off is the act that changes its status. It says this is complete, this is who stands behind it, and this is the state of the building as of this date. A great deal of compliance trouble comes not from bad audits but from audits that were never properly closed, and so never quite became records.

The difference a signature makes

Consider two identical audits of the same building, with the same findings, written to the same standard. One is signed off by a named person on a stated date and then locked. The other sits open, with the findings noted but nobody having formally approved them. The first is a record you can produce under scrutiny. The second is a document that invites every awkward question: who agreed these were the findings, when did it become final, and has it changed since.

The information content is the same. The defensibility is not. A sign-off converts observations into an assertion that a competent person has made and will stand behind, fixed at a point in time. That conversion is the whole value of the step, and it is why an audit without it is only ever half-finished.

What a sign-off actually asserts

A meaningful sign-off carries more than a name. It asserts several things at once, and each of them matters when the record is later read by someone who was not there.

It asserts completeness: the audit covered what it set out to cover, and the gaps, if any, are stated rather than silent. It asserts ownership: a named person, with the competence to do so, takes responsibility for the findings. It asserts a date: the audit describes the building as of a specific day, not some vague recent period. And it asserts finality: from this point the record is fixed, and any change is a new record rather than a quiet edit to this one.

Strip any of those away and the sign-off weakens. An undated approval cannot tell a reader what the building was like when. An anonymous one cannot tell them who to ask. An approval that does not lock the record cannot promise the document has not moved since.

Lock the record at the moment of approval

The single most important consequence of sign-off is that it should freeze the audit. A record that can still be edited after approval is a record that can be quietly improved after the fact, and a reader who knows that can never fully trust the version in front of them. The integrity of the whole audit history depends on approved records being immutable.

This is why the right response to a change in the building is a new dated audit, not an edit to the last one. A clear sequence of point-in-time records, each frozen at sign-off, tells a far stronger story than a single file that keeps being updated. We go into this in point-in-time records: freezing an audit when it is approved, and the broader habit of a defensible trail in an audit trail a regulator can follow without you.

The findings are only half the job

An audit usually produces two things: a picture of the current state, and a list of things that need doing. Sign-off closes the first. It does not close the second. The remedial actions that flow from an audit need their own owners, their own dates and their own closure, and a sign-off that approves the findings while leaving the actions to drift has only finished half the work.

This is where audits quietly fail in practice. The audit is signed, filed and considered done, while the defective fire door it flagged stays defective for months because no one owned closing it. A signed audit with a trail of unactioned findings is not a sign of good management; it is a documented record of known problems left open. The sign-off should mark the start of the remediation clock, not the end of the matter.

Competence behind the name

A sign-off is only as strong as the person making it. Approval by someone without the competence to judge the findings is a signature without weight, and an audit signed off by the wrong person can be worse than one left open, because it carries the appearance of assurance without the substance. The right signatory is someone who can actually stand behind the findings if questioned, which is a question of competence and authority, not seniority for its own sake.

For independent audits this is usually clear. For self-audits it needs thought, because the person doing the work and the person approving it may be the same, and a self-approval carries less weight than an independent one. We look at where each kind fits in self-audits and independent audits: where each one fits.

Make sign-off the natural end of the work

The reason audits go unsigned is rarely deliberate. It is that closing them is a separate step, done later, that gets deferred and then forgotten in the press of the next job. The fix is to make sign-off the natural conclusion of the audit rather than an administrative afterthought, so that an audit is not considered done until it is approved, dated, locked and its actions assigned.

SAMRISK is built around that close: audits are owned and dated, they freeze on sign-off so an approved record cannot be quietly changed, and the remedial actions they raise carry their own owners and deadlines through to closure. You can see how it works on the audits page, and how the same discipline applies to assessments on the risk assessments page. This is general guidance rather than legal advice, but the principle is plain enough: an audit you cannot stand behind is not finished, and the sign-off is what lets you stand behind it.