Continuous assurance: when verification stops being an event

There is a date in the programme with somebody's name against it. Hold point, level three plant room, a week on Tuesday. The client is invited. A QA engineer drives up, stands while a tester runs a set of values, signs a sheet, photographs a length of pipework, and by four o'clock the package is assured. Everyone behaved perfectly well. The date is visible in the programme, the labour is visible on somebody's invoice, and a folder eventually gets a sensible name.

What the date cannot do is carry the facts that were free on the ordinary Tuesday when the work actually went in, and expensive the month somebody tries to rebuild them.

Continuous assurance is the other claim, and it is duller than the phrase suggests. Verification stops being an event when the record accumulates while the work is still live — each inspection and test plan item, each asset tag, each issued revision, written against one another, so that a meeting eighteen months later has nothing left to invent.

We still buy verification as a date

The inspections were bought long ago. Inspection and test plans have hold points. Commissioning has witness sheets. Snagging has a walk. The golden thread, where it applies, carries a duty to keep records available and current. Between them, those things have made verification thorough, well attended and almost entirely ceremonial.

An event is easy to staff, which is most of the explanation. You can put a day in the programme, invite the client, take attendance, produce a photograph proving that a competent person stood in the room, and paint a row green afterwards. It reads beautifully in a progress report. It is also, if we are honest, the cheapest available way to look diligent in retrospect, because nothing about it requires the record to have been true on any earlier morning.

So projects keep buying the event long after they have bought the system of record. Folders have names. Models are federated. Somebody is "on BIM." The plotter still sings at seven in the morning. And the inspector still arrives as though the facts begin when they sign in at the gate. The unofficial set in the trailer is the same failure in a different jacket — the official record was not trusted to be current, so the site kept its own copy of what it believed. A completion walk is that failure at the end of the job; a hold-point visit is that failure in the middle. Both mistake presence for proof.

Presence proves attendance and little else. A signature on a sheet that names no asset, no issued title and no revision is a signature on a ceremony. A witnessed test whose as-left values are still in a notebook in a van is a story about witnessing. And a snagging list invented once occupation is already in the diary is a second register, hired because the first one — the ITP item, the inspection sheet, the tag — was never expected to finish as a record.

Check only at the end and you are auditing a story

The story is usually honest, locally. The inspector inspected. The tester tested. Document control did hold an issued set. The decorator attended the items they could recognise as theirs. Every step was reasonable on the day it happened. What fails is the chain between them.

An audit of a story has a shape you learn to spot. Serials typed up from nameplate photographs, some of them guessed where the label was scratched. Witnesses inferred from a weekly attendance list. As-found and as-left flattened into a single column marked "result." The drawing in the tester's hand remembered as "the latest one." Defects that were never pinned to a sheet surviving as corridor nicknames — the noisy fan, the door that binds. Hold points signed against a package rather than a tag, which means they cannot afterwards be reopened as statements about a particular unit. The O and M then inherits fiction, because fiction is what a late reconstruction produces once the hour has gone.

Labour spent reconstructing is not quality labour. It is archaeology. In the room, the original facts cost nothing: the tag on the unit, the revision in somebody's hand, the setpoint on the instrument, a commissioning engineer still willing to write their name next to a value. After the room empties, every one of those fields becomes an inference drawn by somebody who was not there.

Which is why the reassurance that we already bought quality when we bought inspections tends not to survive contact with a later question. The later question is never whether somebody visited. It is what was verified, against which identity, on which issued information, and whether you can still show it. An event answers the first part. Only a record answers the rest.

Continuous does not mean streaming

Ask most people to picture continuous assurance and they picture a feed. Sensors. A twin that updates itself. A form that submits from the field with a photograph attached. A status moving from amber to green while a meeting watches it happen. That picture is a product tour dressed as a future, and it says nothing about whether the steel fixer, the tester and the facilities supervisor are looking at the same issued fact.

The real version is stricter and much less photogenic. It means the verification record is written at the tempo of the work, against identities that will still mean something after demobilisation, and against the published construction information rather than a corridor name, a procurement code or last Thursday's crop. It means somebody who was never in the room can defend a row without ringing round the original crew, most of whom have moved on.

It does not mean every valve streams, or that a model coordinates itself, or that a hold point closes on a stage because the operator standing beside it is still there to make the answer come out right. Those demonstrations exist already and they prove that a form can be submitted. They do not prove that the project owned a container: this ITP item, this tag as installed, this title and revision, this date, this person.

A feed without those pins is just a live unofficial set. It can be perfectly current on the day and useless six weeks later, because currency without identity is another crop. Continuous assurance does not mean more events, closer together; done properly it means fewer ceremonies, because the writing already happened.

Three dull pins

Miss one of the three and the other two turn into theatre.

The inspection and test plan is the planned sequence of verification, not a spreadsheet of good intentions. It names what must be seen, at which hold point, before which work is allowed to proceed. An ITP that is only a set of package headings — "MEP first fix," "envelope," "commissioning" — has nothing to accumulate. It can only be signed, and signing is an event. An item that can accumulate names the check, the acceptance criteria, the evidence that would close it, and the identity it closes against.

The asset tag is that identity as installed. Not the code purchasing used, not the room nickname, not "AHU as photo." Tags are how a facilities supervisor asks a question in year four. They are how a commissioning hour becomes a register row rather than an album of nameplates. They are how a defect stays the same object after the wall is painted and the photograph is superseded. An ITP that never meets a tag can still close a package; it cannot close an asset. The asset then has to be invented at handover, which is precisely how good quality records fail to become handover records.

The issued set is the construction information the check was permitted to use: title, revision, suitability, and the act of issue to named organisations. A hold point signed against a plot that is not the published container is a hold point signed against the unofficial set. A test run against a superseded sheet is a test of a story. A snag that cannot name the sheet it was judged against cannot tell you whether it is a defect or a change, and that distinction is worth money. ISO 19650 bothers with a published state because "the file is on the disk" and "the file is authorised for this use" are not the same fact. Continuous assurance invents no fifth state. It simply refuses to let verification float free of the four we already agreed to.

Three pins, and one sentence a project ought to be able to say on any given Tuesday: this item, on this tag, against this issued revision, closed — or failed, or still open — on this date, by this person. If saying it means pulling three people off other work for a morning, verification is still an event, whatever the folder is called.

What it looks like when the visit stops mattering

The version worth having does not look like a new ceremony. It looks like the event becoming optional, because the record already exists.

On an ordinary morning, three people who do not share an employer can say, for the work in front of them, which hold points are closed, which tags those closures belong to, and which issued revision the work was judged against. The site copy, the trailer copy and the contract administrator's folder agree with each other. A failed first pass is still findable — tidy histories in which only the eventual pass survives are how stories get written. A superseded sheet is withdrawn from the live check rather than left on the plywood because somebody will "know." If a completion walk happens at all it is a short residual list with owners, live photographs and pins to the issued set, and not the moment quality begins.

None of that is a gadget problem. The kit on site will still include A1s, because gloves and low winter sun do not care about a tablet. Companies will not have merged into a single platform, and they never will. Inspectors will still attend some tests, because some facts genuinely need a witness in the room. What stops is the habit of treating the attendance as the assurance. Either it becomes a check on a record that was already accumulating, or it is the old event under better lighting.

CDM, the Building Safety Act, ISO 19650, NEC, FIDIC, JCT and COBie all have owners, and all of them assume a contemporaneous record of what was inspected, tested and left behind. None of them treats a late walk as evidence that the Tuesdays happened.

The same failure at different dates

Look at how quality and completion usually goes wrong and it is rarely a hunt for a better punch-list app. It is one problem, arriving on different dates.

Snagging lists become the place projects go to die because the list is a late second register: unowned items, superseded photographs, nothing pinned to an issued sheet. Quality records are handover records, and most teams discover this when the pack is already late and the ITP that never met a tag has quietly turned into fiction in the O and M. Inspection and test plans tied to asset tags from day one are how a register assembles itself instead of being retyped by an administrator in the last fortnight. Commissioning data captured in the hour the test ran is where the asset register is actually born; captured later, it is folklore with a filename. A defects workflow the subcontractor will not open is a list the main contractor ends up performing for free. A handover readiness review at sixty per cent complete is a gate, while a handover meeting at ninety-eight per cent is a surprise. And the golden thread, in practice, is a duty to keep the right records available rather than a new file type to buy.

Those are not seven separate problems. They are one informational claim, restated until it closes. Verification that is only an event will reliably produce a late second register, a reconstructed commissioning hour, a binder that is already behind, and a completion meeting spent bargaining over an artefact nobody designed to finish. The event can stay. It just stops being the job.

Which makes this an argument about handover

Handover is when a project wants the record to be finished. Operations is when somebody actually needs it. Where verification was an event, handover becomes a reconstruction: O and M manuals assembled as four hundred PDFs, an asset register rebuilt from rooms somebody walked with a clipboard, warranties chased out of vendor mail, COBie applied once at the end, a twin frozen at practical completion. Owners then wait — often a year — for data they have already paid to produce, because none of it was written against tags and issued containers while the installer was still on site and still remembered.

That wait does not begin when the keys move, whatever the facilities team is told. It is the same quality failure, still running. Progressive handover, if it is to mean anything at all, is continuous assurance under a different name: validating asset data throughout delivery instead of end-loading a spreadsheet once the trades have gone. The day-one-operable building is the same test taken at the door. The twelve-month handover is what you get for declining it.

The appointing party is the buyer of the ceremony, so they are the ones who can stop paying for it. Put the three pins in the inspection appointment: each ITP item closed against a tag and an issued revision, by a named person, on the day the check ran — that is the deliverable, not the attendance sheet. It costs a slower hold point and a named hour on the tester's timesheet; it is still cheaper than the reconstruction that currently lands on the O and M team after the trades have gone.

Before you buy or rebuild the inspection system, ask whoever is selling it to reopen one closed package from last year while you watch — item, tag, revision, as-left values. If they need the original crew, you are still buying an event.