Building compliance across multiple sites without a spreadsheet

Most portfolios can tell you that a certificate exists somewhere. Far fewer can quickly show which building or asset it covers, what obligation it satisfies, whether it raised a finding and who is responsible for the next action.

The duty exists whether or not a spreadsheet remembers it. A compliance system should make the position ordinary to establish, not a forensic exercise before an audit, incident or board meeting.

Compliance is more than a certificate register

Building compliance means knowing which duties apply to a property, carrying them out at the right time and being able to prove what happened. Across a commercial, residential or mixed-use portfolio, those duties can include fire safety, electrical and gas safety, lifts, water hygiene, asbestos management, access, energy performance and plant maintenance.

Certificates matter, as do test reports, permits, inspections and maintenance records. But a list of documents is not yet a compliance position: a certificate may cover only part of a building, an inspection may identify a defect, and uploaded evidence may still require review.

The useful unit is therefore not the file. It is the obligation and its operating chain: applicability, control, inspection or work, finding, remedial action, evidence and verification.

Inspected is not compliant. Submitted is not verified. Assigned is not completed. Those distinctions are where strong operational control begins.

A central spreadsheet often starts with a sensible intention: one place to see what is due. For a single building with a small number of recurring duties, it can be useful. As sites, assets, local regimes, contractors and internal owners multiply, it becomes a memory aid rather than an operating record.

Dates drift, certificates sit elsewhere and corrective work becomes disconnected from the finding that prompted it. Most importantly, the record must distinguish different kinds of absence:

• No obligation applies.
• An obligation applies but has not been recorded.
• An obligation is recorded but evidence has not been supplied.
• Evidence has been supplied but not reviewed.
• The duty has been reviewed and is genuinely complete.

These are not interchangeable states. Unknown is not compliant, but it is not automatically non-compliant either: it is an unresolved question that needs a named response.

A blank must never be allowed to look like a pass.

Put obligations on the building, with local context

Each building should carry its own applicable duties, due dates, controls, evidence, findings and history. Where appropriate, duties should narrow further to a space, system, asset or activity. A lift obligation belongs with the lift; a water-hygiene control may belong with a system and its associated locations.

The system should know what the record applies to before it knows when the next review is due. It should preserve the source of that applicability, whether it comes from a legal requirement, lease, insurance condition, standard, supplier agreement or internal policy.

That also means being country-aware. The same asset may exist in Amsterdam, London and Madrid, while the applicable regime, responsible party, frequency, documentation and approval process differ. A single hard-coded inspection frequency will be wrong somewhere.

A portfolio can have one governance approach without pretending every country has the same rules. The reusable model identifies obligations, assigns responsibility, plans controls, records outcomes, connects findings to action and retains evidence and decision history. Local applicability remains specific to the building, country, asset, use and governing requirement.

When a building enters the portfolio, onboarding should establish which duties apply and what evidence is needed to demonstrate control. Copying rows into a tracker is not a substitute for that work.

Connect findings, responsibility and evidence

The most dangerous gap in compliance is the gap between finding and remediation. A report may prove that an inspection took place and that a defect was identified; neither proves that the risk has been resolved.

A complete record connects the finding to the real-world response:

• The affected building, space or asset, and the nature and severity of the issue.
• The required corrective action and responsible person or supplier.
• Relevant approval, access or budget decisions.
• The target date and escalation route.
• Evidence that work was completed and the review confirming closure.

This is where compliance, maintenance, procurement, finance and operations meet. Corrective work may need a supplier, permit, approved budget, planned shutdown or resident communication. The compliance position should not lose sight of the issue while those things happen elsewhere.

Every material duty also needs a clear owner, with the responsible role, person and scope recorded. Naming somebody is only the start: the record should show what they were asked to do, what authority they had, what decisions were made and what remains outstanding. That creates continuity when people change role, contractors rotate or a building changes hands.

Audit readiness depends on this history. It means being able to reconstruct what applied at a given point in time, what happened, what evidence existed, who reviewed it and what decision was made.

Certificates should link to their scope, findings should remain visible until remedial work is evidenced and reviewed, and changes should retain the earlier position. Audit packs should assemble from live records rather than being retyped before a visit.

::: Audit packs Assembled is not accepted. An audit pack is the organisation’s evidence-backed case; acceptance remains the decision of the party entitled to assess it. :::

Make uncertainty visible and keep decisions governed

Once obligations are held at building level, the portfolio view can show more than a wall of green statuses. Leaders need to see what is due, overdue, awaiting evidence review or carrying an open finding, alongside gaps in responsibility and coverage.

A mature compliance view does not optimise for reassurance. It shows what is happening, why it matters, who is responsible and what must happen next.

AI can help with preparation and monitoring: reading reports, identifying assets and dates, classifying evidence, detecting missing fields and flagging expiring obligations. It can prepare proposed summaries linked to source material and help teams spot findings with no associated remedial action.

But it cannot silently turn extracted text into an accepted operational fact. It should not decide that a building is compliant, close a safety-critical finding, alter legal applicability or approve a material disclosure. Those decisions require the right person, the right authority and a record of why the decision was made.

What this means

Building compliance is a living operating record, not a spreadsheet, document store or once-a-year audit pack. The role of a Property Operating System is to connect obligation, asset, inspection, work, evidence and responsibility into one governed operating picture.

• Establish applicable duties at building and asset level, including their source and local context.
• Connect findings to remedial work, completion evidence and review.
• Give unresolved gaps a named owner and a next action.
• Keep unknowns visible and preserve the history behind decisions.