The metric that vendors can move
Compliance technology is sold against the measure it is able to improve, and in the policy administration category that measure is almost invariably the completion rate. A platform is procured, reminders are automated, and an organization that was attesting at forty percent is attesting at ninety-plus within a quarter. The improvement is real, it is visible on a dashboard, and it is reportable to a board. It is also, standing alone, a poor indicator of whether the organization has acquired any additional capacity to defend itself.
The difficulty is not that completion rates are meaningless. Coverage is a genuine problem, and an organization that cannot get its workforce to acknowledge its policies at all has a defect worth correcting. The difficulty is that completion is a distribution metric being used as a proof metric, and the two diverge precisely at the point where the record is examined. An attestation record is not evidence because it exists. It is evidence because it establishes attribution: that a particular individual, and not merely a particular account, performed a particular act with respect to a particular document on a particular date. Completion rates measure how many records exist. They do not measure whether any of them establishes that.
Completion rates measure how many records exist. They do not measure whether any of them establishes that.
This distinction is not theoretical, and the governing law on it is older and better developed than most policy administration programs assume.
What a court does with an attestation record
The California Court of Appeal’s decision in Ruiz v. Moss Bros. Auto Group remains the most instructive published treatment of the problem, in part because the employer in that case had done what most organizations believe is sufficient.
The employer sought to compel arbitration on the basis of an agreement contained within an employee acknowledgment form. It produced the executed document, bearing the employee’s printed name followed by the notation of electronic signature and a timestamp specific to the second. It produced a declaration from its business manager attesting that each employee was required to log into the company’s human resources system using a unique login identifier and password in order to review and electronically execute the acknowledgment form. In other words, the employer held a completed attestation record, generated through an authenticated login, timestamped, and stored. On any completion dashboard, this employee was compliant.
The court held that the employer had not carried its burden. Electronic signatures are expressly valid under California law, and the court took care to say that the authentication standard is not difficult to satisfy. What it identified instead was a gap in inference. The declaration established that all employees were required to log in and sign. It did not establish that this employee performed this act. The evidence that the record was attributable to the individual, rather than merely associated with the individual’s account, was absent, and the petition failed on that basis. The relevant statutory provision, in California and in the corresponding electronic transactions law adopted elsewhere, turns on whether the electronic signature was the act of the person, and an organization that cannot connect its process description to the specific record has not addressed that question.
Courts have continued to treat these disputes as fact-intensive inquiries, resolving them on the specificity with which the employer can describe how the individual record came to exist. The controlling variable is not whether an attestation was obtained. It is whether the organization can reconstruct, with particularity, the process by which that individual encountered that document and acted upon it.
Why rapid remediation produces weak records
There is a further problem, less often noticed, in the manner by which completion rates are typically raised.
An attestation campaign that moves an organization from forty percent to ninety-six percent within thirty days does so through automated reminder sequences applied to a population that had not previously engaged. The resulting records share characteristics that are discoverable and are not favorable. They cluster in time. They follow escalating prompts. Their dwell times, where the system captures them, are frequently shorter than the time required to read the document. A plaintiff seeking to establish that assent was perfunctory has, in that data, a substantially better factual record than the employer does.
The point is not that automation is inappropriate or that reminders are improper. It is that the same instrumentation which produces a favorable headline metric also produces the detailed behavioral record from which an adverse inference may be drawn, and organizations rarely examine what their attestation system is recording alongside the completion event. An acknowledgment obtained after four automated escalations, executed in eleven seconds against a nineteen-page document, is a record the organization created and will be required to produce. Whether it strengthens or weakens the organization’s position depends on facts that were determined at implementation and are not recoverable afterward.
The generalizable failure is metric substitution. Governance programs adopt the measure their instrumentation can produce, vendors optimize against the measure buyers have adopted, and the measure gradually displaces the capability it was intended to proxy. Completion rate stands in for defensibility in the same way that training hours stand in for competence and audit closure rates stand in for control effectiveness. In each case the substitution is invisible until the underlying capability is tested, and in each case the test occurs at the least convenient moment.
What an evidentiary attestation architecture requires
The remedial specification is narrow and can be stated concretely, which is the principal reason organizations should insist on it at procurement rather than discovering it in litigation.
The record must bind four elements as a single unit: the identified individual, the specific document version, the date and time, and the authenticated pathway by which the individual reached the document. Systems that capture the first three and treat the fourth as infrastructure rather than as evidence produce exactly the record that failed in Ruiz. The organization should be able to state, for any single attestation selected at random, how that individual authenticated, what was displayed, in what version, and on what date, without relying on a general description of what all employees are required to do.
Version binding deserves particular emphasis because it is the element most commonly absent. Where the organization cannot establish which version of a document an individual acknowledged, it has a record that the individual acknowledged something. If the provision now in dispute was added in a later revision, that record may be worse than none, since it invites the demonstration that the acknowledged version did not contain the term at issue.
Retention must be architected at the point of creation rather than at the point of need, and must survive system migration. Policy administration platforms are replaced on cycles considerably shorter than the limitations periods governing employment claims, and an attestation record that cannot be exported in an authenticated form is an asset with an expiration date the organization has not calculated.
Finally, the completion rate should be reported as what it is. It is a coverage indicator, useful for identifying populations the process is failing to reach. It is not a compliance indicator, and it should not be presented to a board as one. An organization reporting ninety-six percent attestation has reported that ninety-six percent of a population generated a record. Whether those records would survive examination is a separate finding, obtainable only by attempting to produce a sample of them under the standard a court would apply.
Governance implications
The recommendation follows the pattern established in the preceding analysis in this series. In May the argument concerned systems that were inside the regulatory perimeter without having been recognized as such. In June it concerned obligations that generate evidence requirements rather than policy requirements. The present case is the third form of the same error, in which an organization possesses the artifact the obligation calls for and has not established that the artifact does the work.
The diagnostic is an adversarial production test conducted against a sample rather than a review of aggregate metrics. Select individual attestations, attempt to assemble the complete evidentiary chain for each, and assess the result against the authentication standard rather than against the organization’s own process documentation. Where the chain cannot be assembled, the gap is architectural and will not be closed by raising the rate.
Organizations should be candid with themselves about which of these two conditions their compliance program was built to produce. Both are legitimate objectives, and the first is considerably cheaper. Only the second is a defense.
References
Ruiz v. Moss Bros. Auto Group, Inc., 232 Cal. App. 4th 836 (Cal. Ct. App. 2014).
California Civil Code §§ 1633.7, 1633.9 (Uniform Electronic Transactions Act as adopted in California), addressing the legal effect of electronic signatures and attribution of an electronic signature to the act of a person.
Electronic Signatures in Global and National Commerce Act, 15 U.S.C. § 7001 et seq.
29 C.F.R. Part 1602 (recordkeeping and retention of personnel records).
Novara Consulting Group, “The Development Exception: Internal Mobility Platforms and the Perimeter of Employment AI Governance,” May 2025.
Novara Consulting Group, “The Evidentiary Burden: Policy Currency, Attestation, and the Distance Between Compliance and Its Demonstration,” June 2025.