Learn · 2 min read

A practical checklist for auditable digital signatures

Seven questions worth answering about a signed document before an auditor, regulator, or counterparty asks them for you.

TL;DR

An auditable signature isn’t just "signed", it’s embedded in the file, chains to a recognized trust list, carries the right legal level for its purpose, has a qualified timestamp, and is built to stay checkable for as long as the document needs to survive. Most gaps show up in one of these seven areas.

1. Is the signature embedded in the file, not just recorded by a platform?

An embedded PAdES/XAdES/CAdES signature can be checked independently of the platform that created it. A platform-recorded signature can only be confirmed by asking that platform. See the risk of platform-tied signatures.

2. Does the certificate chain to a recognized trust list?

Check against the EU LOTL for EU-qualified signatures and seals, and against Adobe’s AATL for Acrobat-level trust without an EU qualification. A self-signed or unrecognized certificate proves nothing an auditor can rely on.

3. What legal level does the signature actually carry?

Simple, advanced, and qualified electronic signatures carry different legal weight under eIDAS Article 25. Only a qualified signature has automatic EU-wide equivalence to a handwritten one. See is my e-signature legally binding?

4. Is it a signature (natural person) or a seal (legal person)?

A qualified seal carries an Article 35 presumption of integrity and origin, not handwritten equivalence. Confusing the two is a common source of overclaiming. See what is a qualified electronic seal?

5. Is there a qualified timestamp, not just a claimed signing date?

A timestamp from a qualified trust service provider establishes when the signature was applied independently of the document’s own metadata, which can be altered. A signing date with no cryptographic timestamp behind it is an assertion, not evidence.

6. Will it still validate in five or ten years?

Certificates expire and revocation records don’t last forever. A long-term-validity profile (PAdES-B-LTA) embeds the evidence needed to check the signature long after the certificate itself has lapsed. See future-proofing signed contracts.

7. Has anything changed since signing?

The seal covers the exact bytes of the file at signing time. A validator should confirm the document is byte-for-byte unchanged since then, not just that a signature exists somewhere in it.

Using this in practice

This isn’t a legal compliance checklist and doesn’t replace advice specific to your regulatory context. It’s the practical, technical version: the questions a validator actually needs to answer to tell you whether a signed document holds up as independent evidence, versus one that depends entirely on trusting whoever created it.

Was this helpful?