The Binding Chain: Auditing Signatory Authority Across a UK Professional Firm

In many UK professional firms, the power to bind the organisation is treated as a matter of seniority rather than a documented control. A partner signs an engagement letter, a director approves a bank payment, a practice manager submits a regulatory filing, and the transaction proceeds. The difficulty arises when roles change, people leave, limits drift or a document type is overlooked. A signature register is not simply a list of names. It is a control document that connects a named individual or role to a defined instrument, a financial limit, a period of authority and the evidence that supports the arrangement.

Begin with the instruments, not the names

A common mistake is to start by listing senior people and asking what they can sign. A more reliable method is to start with the documents and commitments that bind the firm. These typically include client engagement letters, contract variations, non-disclosure agreements, supplier contracts, settlement offers, bank mandates and payment instructions, regulatory filings, tax submissions, formal client notices, data processing agreements and references. For each instrument, the firm should define what constitutes a binding commitment. Some documents require a single authorised signature; others require dual authorisation, a board resolution, an LLP member decision or a specific regulatory approval. The register should record the required formality, not merely the name of the signatory.

This instrument-first approach also exposes gaps. A firm may have a clear policy on engagement letters but no rule for who may vary a fee, terminate a client relationship or send a formal notice by email. In a hybrid working environment, an email from a senior fee-earner can create as much exposure as a signed contract. The register should therefore cover electronic signatures, portal submissions and formal correspondence, not only wet-ink documents.

Define authority in plain, auditable terms

Each entry in the register should answer a small set of questions. Who holds the authority? Is it attached to a role, a named individual, or both? Which instrument does it cover? What is the financial limit, if any? When does the authority expire or fall due for review? Who may act as a substitute? What evidence supports the delegation, such as a board minute, partnership deed, written delegation or job description? Where is the source document stored?

It is useful to separate approval from execution. A firm may permit a senior manager to approve a supplier invoice up to a stated value, while only a director or member may execute the underlying contract. Similarly, routine client updates may be sent by a relationship manager, but formal notices of termination or fee disputes may require review by a partner or compliance function. These distinctions should be written down. A register that records only job titles invites interpretation, and interpretation is where unauthorised commitments begin.

Audit the existing position in five passes

A practical audit can be completed without a large project team. First, collect the source documents: bank mandates, board or member minutes, delegated authority matrices, finance system roles, client relationship management permissions, e-signature templates and regulatory portal user lists. Second, interview the functions that rely on authority daily, including finance, compliance, human resources and practice management. Third, test a small sample of transactions. Select recent payments, contracts, filings and formal client notices, then trace each to a documented authority. Fourth, record gaps and ambiguities, including leavers who remain on a mandate, expired limits, shared portal credentials and informal approvals. Fifth, produce a short findings memo with an owner and a deadline for each action.

The audit should be proportionate. Its purpose is not to create a disciplinary record but to establish whether the firm can demonstrate that the person who signed was entitled to do so. Where authority is unclear, the register should record the uncertainty and the interim control until a decision is made.

Treat the bank mandate as a priority control

Bank mandates are a frequent weak point because they outlive role changes. The firm should reconcile the mandate to the register at least quarterly, checking named signatories, payment limits, dual authorisation requirements, online banking tokens and direct debit arrangements. When a signatory leaves, access should be removed promptly and the change evidenced. Informal arrangements, such as a former partner retaining a token for convenience, should be discontinued. The same discipline applies to regulatory portals and filing credentials, where shared logins can obscure who actually submitted a document.

Establish a quarterly review routine

A quarterly review is sufficient for most firms if it is consistent. The agenda should cover joiners and leavers, role changes, new document types, expired limits, sample testing, bank mandate reconciliation and portal access. The register owner, often the chief operating officer, company secretary or compliance lead, should update the register, record the version and circulate it to relevant functions. The review should take less than an hour when the register is maintained continuously rather than reconstructed from memory each time.

The register should also be linked to onboarding and offboarding checklists. New starters should not receive signing authority by default; departing staff should not retain it by inertia. Procurement and client teams should be able to check the register before sending a contract or a formal notice. A simple rule helps: no authority without a line in the register.

Keep the register usable

A register that is too complex will be ignored. A spreadsheet or controlled shared list is usually adequate, provided it is access-restricted and version-controlled. Each entry should be readable, with clear status indicators for active, expiring or suspended authority. Source documents should be linked or referenced. The register should be reviewed annually at board or management level, with quarterly operational checks in between.

Where an unauthorised signature is discovered, the firm should preserve the documents, assess the legal and regulatory position, consider ratification where appropriate and identify the root cause. The lesson should be fed back into the register and the delegation process.

A signature register is ultimately a statement of how the firm governs commitment. The important question is not who signed yesterday, but who can bind the firm tomorrow. In 2026, with distributed teams, electronic signatures and multiple filing portals, that chain of authority needs to be explicit, current and evidenced.