A compliance audit trail is a set of records, made at the time, that show who did what in your building, when, and what happened next. Most buildings already keep the records. The question is whether they'd hold up if someone challenged them, and whether you could find them quickly, for one building or twenty.
This page sets out five tests any building record should pass, and shows what they look like at the front desk, the key cupboard and the plant room. One thing to say up front: a good record shows what happened. It doesn't, on its own, prove that what you did was enough to meet a legal duty. That judgement still sits with you and your advisers.
A record holds up when it was made at the time, names the people involved, shows what happened next, changes only with a trace, and turns up when you search your portfolio. Here's what each of those means in practice.
A note written up a week later, from memory, carries far less weight than one made as it happened. If your team catches up on the visitor log at the end of the shift, the record is already weaker than it looks.
"Visitor signed in" tells you very little. "Signed in by reception, for this host, at 9:42" tells you who, when and why. The same goes for keys, contractors and reports: a name turns an entry into evidence.
A report with no response attached proves the problem, not the action. The most useful records carry the whole story: what someone reported, who picked it up, and when they closed it.
If anyone can quietly edit a spreadsheet, nobody can be sure what it said on the day. Records can change. What matters is that each change shows who made it and when.
A record sitting in one building's filing cabinet isn't much help when the question covers twenty. Being able to search the same kind of record, in the same format, across every building is what turns a set of files into an audit trail.
Most building records pass the first test. The last two are where they usually fail.
The tests are easiest to see in the everyday moments a building team deals with. The table below shows what a record that fails looks like, next to one that passes.
| The moment | A record that fails | A record that passes | Tests it meets |
|---|---|---|---|
| A visitor arrives at reception | A name scrawled in a paper book, no host, no time out | Signed in against a named host at 9:42, signed out at 11:15 | 1, 2 |
| A contractor takes the plant room key | "J. — contractor" in a register kept in a drawer | Issued to a named contractor at 14:00, returned at 16:30, linked to the job | 1, 2, 3 |
| An occupier complains at the front desk | An email forwarded on, with no reply on file | Logged with a time, routed to a named person, response and closure attached | 2, 3 |
| Someone corrects an entry a week later | A shared spreadsheet anyone can overwrite | The system logs the edit, with who made it and when | 4 |
| A landlord asks a question about every building | Each building keeps its records its own way | The same records, in the same format, searchable in one place | 5 |
None of the "passes" column needs more effort from your team. It needs the record to be made as part of doing the job, in a place that keeps it.
Building records usually break down at the joins between systems, not inside any one of them. The visitor book is at reception. The key register is in a drawer. Contractor details sit in a spreadsheet the FM company keeps. Complaints arrive by email, phone and WhatsApp. Occupier notices go out from somebody's inbox.
Each of those might pass the first three tests on its own. Try to answer one question across them, and the gaps appear. Who was in the building when someone reported the incident? Which contractor held the plant room key that afternoon? Did anyone tell the occupier about the change, and when?
Staff turnover makes it harder. The person who knew where everything was has often moved on by the time anyone asks. An audit trail spread across three systems and a spreadsheet isn't really an audit trail. It's a lost weekend in January.
Because almost every compliance duty landing on managing agents leans on the same records. A few examples show the pattern. The dates themselves are set out in the compliance calendar.
| Duty | The records it leans on |
|---|---|
| Fire risk assessment (in force) | The full written assessment and your fire safety arrangements |
| Third-party harassment (from 30 October 2026) | Visitor sign-in, front-desk reports and what you did about them |
| Heat network registration (by 26 January 2027) | Consumer numbers by network and the complaints you've handled |
| Martyn's Law (expected, no date set) | Visitor and access records across an estate |
The fire safety duty is the one already in force, so it's worth being precise about it. In England, section 156 of the Building Safety Act 2022 amended the Fire Safety Order from 1 October 2023. For premises the Order covers, which include non-domestic premises and the common parts of multi-occupied residential buildings, the responsible person must now record the fire risk assessment in full, including all its findings, and record their fire safety arrangements. If they engage someone to help make or review the assessment, they must record that person's name too. Before the change, the Order only required a record of the significant findings, and only in certain cases, such as employers with five or more staff.
Here's where the distinction from the start of this page matters. Records that pass all five tests show what happened and what you did. They don't decide whether what you did was enough. That depends on the duty, the premises and the circumstances, and it's a question for the responsible person and their advisers.
The Managing Agent's Compliance Calendar 2026–27 →
A producible audit trail is one your team builds without noticing, because the recording happens as part of the job. Visitors sign in against a named host. Contractors complete their induction before they start. Keys go out and come back against a name and a time. Reports taken at the desk go straight to the person who deals with them, and the response stays attached.
Locale helps your team keep those records in one place, as they work. Visitor management, contractor inductions, key management, front-desk reports and occupier communications sit on one platform, built as one, under your building's own brand. Around 1,200 buildings run on Locale today, and 92% of customers stay. It can help you produce the record quickly when someone asks. It can't decide whether what the record shows meets a legal duty.
Key management software with a full audit trail →
Visitor management for commercial buildings →
The Managing Agent's Compliance Calendar 2026–27 sets out every dated item that reaches a commercial or mixed-use managing agent between October 2026 and August 2027, and what each one asks you to produce. It's free.
Download the Compliance Calendar 2026–27
A compliance audit trail is a set of records, made at the time, showing who did what, when, and what happened next. In a managed building that usually means visitor and contractor sign-in, key records, reports taken at the front desk with the response attached, and occupier communications. It shows what happened; it doesn't by itself prove that a legal duty was met.
At a minimum, a building manager should be able to produce visitor and contractor records, key issue and return records, and front-desk reports with what happened next. Add occupier communications, plus the written fire risk assessment and fire safety arrangements. Coming duties, including third-party harassment and heat network registration, lean on the same core records.
In England, the Fire Safety Order has required responsible persons to record the fire risk assessment in full since 1 October 2023, along with their fire safety arrangements, for all premises the Order covers. That includes non-domestic premises and the common parts of multi-occupied residential buildings. Before then, the Order only required a record of the significant findings, and only in certain cases.
A reliable building record was made at the time, names the people involved, shows what happened next, logs any later changes, and is easy to find across the portfolio. A record like that is good evidence of what happened. Whether the action it shows was legally sufficient is a separate question.
Building audit trails usually break down at the joins between systems. Visitor books, key registers, contractor spreadsheets, email and messaging apps each hold part of the story. Answering one question means stitching them together by hand, which is slow and error-prone, especially after staff changes or across several buildings.
Detail verified as at 29 September 2026.