Report Sign-Off
A finished assessment is a record. Sign-off is what turns it into an attested record: a named person stating, on a date, that they reviewed the assessment and that its responses are accurate to the best of their knowledge.
Who signs, and what they are saying
Your organization signs. The signer confirms they are authorized to act for the organization, that they reviewed the assessment in full, and that its responses and supporting information are accurate and complete to the best of their knowledge on the date of signing. The statement names no law and is shown in full before signing. A signature is your organization's own statement about its program. It is not a certification of compliance by Backsplice or anyone else.
The customer statement is deliberately not a sworn or perjury declaration — we are not a law firm, and an attestation should not pretend to be a legal oath.
Signing inside the app
Open the completed report and use the sign-off panel. Signing is for org admins (not delegated admins) and asks for your password and a second factor at the moment you sign. You must tick the agreement box explicitly; the button alone is not consent. Signing records your name, title, IP address, and the timestamp.
Sending it to someone without an account
The person who should sign is often an owner, principal, or compliance officer who does not use Backsplice day to day. You do not need to create an account for them.
From the completed report, choose Send for signature and enter their name, email, and title, plus an optional note explaining what you are asking for. They receive a private link that:
- signs once; after that the link, and the report it opens, stop working;
- expires after 14 days;
- shows them the report summary and the exact statement they are agreeing to;
- opens a read-only copy of the full report (the score, the answers and the findings) that they can read as often as they need before signing. Reading it does not use the link up, and it offers no download;
- grants nothing else — no dashboard, no other assessment, no ability to change any answer.
The link is shown to you once when you send it, so you can pass it along another way if email is unreliable. Treat it like a password: anyone holding it can read and sign that one report.
Sending to an outside signer and signing inside the app both work on Premium and Enterprise, and during the demo.
If you need to cancel
Withdraw an outstanding request from the same panel. That kills the link immediately. You can then send a fresh one — only one request can be outstanding per report at a time, so withdraw before re-sending.
What gets stored, and why it matters at audit time
The exact wording the signer agreed to is copied into the record, together with a version stamp. It is never reconstructed from today's text.
This matters: if the attestation wording is ever revised, a report signed last year still shows the wording that was actually agreed to last year. An auditor asking "what did they attest to, and when?" gets a straight answer. For the same reason, a signature is permanent — it is never removed by ordinary housekeeping, even if the original request record is cleaned up later.
The signature block appears on the report in the app and in the exported PDF, which is what an auditor usually receives. PDF export comes with a plan; it is not in the demo.