A sign-off record across five departments

One number in your disclosure — Scope 1, say — passed through four departments before it reached the page, and no single person who touched it saw the whole journey. That is the problem this piece is about, and it is an organisational problem rather than a technical one.

The problem: five owners, one number

Facilities reads the meters and owns site energy. Operations owns fleet fuel and process data. Procurement holds whatever suppliers submitted. Sustainability owns the emission factors, the organisational boundary and the methodology. Finance owns consolidation and the disclosure itself.

Every one of them is doing their job properly. The figure still ends up unsupportable, because the evidence does not travel with the data across the handovers. Facilities has the meter readings in a system Sustainability cannot see. Procurement has the supplier email. Sustainability has a spreadsheet with a factor in it and no note of which publication year it came from. Finance has a number.

Then someone asks, in the following March, why the figure is what it is.

Who reviews what, and who cannot

The instinct in most companies is to have the sustainability lead review everything, because they understand it best. That is exactly backwards, and it is worth being blunt about why.

A review is not a quality check. It is a structural opportunity for a second person to say the figure is wrong. If the person reviewing built the calculation, that opportunity does not exist, no matter how careful they are. The problem is not their diligence; it is that they cannot be surprised by their own work.

So the practical allocation looks like this. Facilities and Operations can review their own source data, because they know what a plausible meter reading looks like and nobody else does. Procurement can review supplier submissions on the same basis. Sustainability can review the calculation, and can approve the methodology, because that is their domain and their authority. Finance approves the disclosure, because Finance is accountable for the report it appears in.

And the rule that makes the rest work: nobody reviews or approves anything they built. This is the one I would not bend, because the moment you do, every downstream control becomes decorative.

The fields the record needs

An approval that cannot be tested is not a control. Six fields is what makes it testable.

What. The figure with its unit, period, scope and entity. “Scope 2 approved” means nothing a year later when there are four entities and two restatements.

Which version. The exact value approved. Without it, a later change is invisible, and an approval that silently attaches to a different number is worse than no approval, because it looks like assurance.

Who. A named individual. Not “Finance”, not a shared mailbox. Somebody an assurance provider can ask a question of.

In what role. Preparer, reviewer or approver, and the authority they held. The same person may legitimately be a reviewer on one figure and a preparer on another; the record has to say which.

When. A timestamp the approver did not set themselves. A date typed into a cell is a claim about when something happened, not a record of it.

On what basis. What evidence was in front of them. This is the field that is almost always missing, and the one your assurer will ask about first.

A worked example, end to end

Take one figure: Scope 1 stationary combustion for a UK site, FY2026.

Facilities exports twelve monthly gas readings from the building management system and files the export, unedited, with the date it was taken. That is the source evidence. The facilities manager reviews it for gaps and obvious anomalies, and notes one estimated month where the meter failed.

The sustainability analyst converts consumption to CO2e using a published factor, recording the publisher, the publication year and the exact factor value against the figure rather than in a separate tab. The estimated month is flagged as an estimate with the basis of the estimate written down.

The sustainability lead reviews the calculation — not the meter data, which they cannot assess — and approves the methodology, including the treatment of the estimated month.

Finance consolidates the site into the group figure, checks the boundary treatment against the stated organisational boundary, and approves the disclosed number.

What exists at the end: four records, four named people, four timestamps, one unbroken line from a meter to a published figure, and a documented estimate rather than a silent one. That last part matters more than it sounds — a disclosed estimate is a judgement, an undisclosed one is a problem.

Running it without a system

You can do all of the above on paper, and for a single entity in a first cycle I would not talk anyone out of it.

What you need is a controlled register with one row per disclosed figure and columns for each of the six fields; a dated approval memo per figure or per group of figures, naming the reviewer and the approver and what they reviewed; and a numbered evidence folder where filenames are never reused. Keep the register in one place, with one owner, and a rule that rows are added rather than overwritten.

Done properly this is genuinely defensible. I have seen assurance providers accept it without complaint, because it answers the questions they actually ask.

Where the manual version breaks

Three places, and it is worth knowing them in advance rather than discovering them in year two.

Volume. One entity and thirty figures is a register. Six entities, three periods and a restatement is a filing system, and filing systems drift.

Restatement. The manual version handles the first version of the truth well and the second version badly. When a figure changes in November for a period that closed in June, you need the old value, the new value, who authorised the change and why — and a spreadsheet gives you the new value, in place, with the old one gone. This is the failure mode explored in spreadsheets and IFRS S2 controls.

The register itself. The awkward question is whether anyone could have edited it afterwards, and in a shared file the honest answer is usually yes. That does not invalidate the work, but it is the point at which a practitioner stops relying on the control and starts testing the underlying figures instead — which means more requests landing on your team. You can try to alter our activity log if you want to see what the alternative behaves like.

The position: the hardest part of this is not the record, it is deciding who is accountable for which figure. That decision is free, takes an afternoon, and is the thing most companies have not made. Every tool in this category, ours included, assumes you have already made it — and the ones that pretend to make it for you are selling an org chart, not a control.

Common questions

Who should approve a climate disclosure figure?

Whoever is accountable for the report the figure appears in, which in practice means finance rather than the team that produced the data. The approver needs the authority to hold the figure and enough context to challenge it. What matters more than the job title is that the approver did not prepare the number themselves.

Can the person who prepared a figure also review it?

No. A review exists to give a second person the opportunity to say the figure is wrong, and a preparer reviewing their own work cannot provide that. This is the one rule in the whole process worth treating as non-negotiable, because every other control depends on it.

What does a sign-off record need to contain?

Six things: the figure with its unit, period, scope and entity; the exact version approved; a named person rather than a team or mailbox; the role they held; a timestamp they did not set themselves; and the evidence they had in front of them. A status field reading Approved contains none of these.

Can we run this without buying software?

Yes, for one entity and one cycle. A controlled register with one row per figure, a dated approval memo naming the reviewer and approver, and a numbered evidence folder will get you through a first cycle. It breaks on volume, on restatement, and on the question of whether the register itself could have been edited afterwards.