TL;DR: The Golden Thread isn't a document — it's a living audit trail that proves your building is safe and you're managing it properly. This guide walks you through what records you need, how to structure them, and how to build a digital audit trail that satisfies the Building Safety Regulator.
Read the complete Golden Thread guide →
What the Golden Thread Actually Requires
The Golden Thread of building safety information, introduced by Section 88 of the Building Safety Act 2022, requires you to create and maintain accurate, up-to-date information about your higher-risk building throughout its lifecycle. The Higher-Risk Buildings (Keeping and Provision of Information etc.) (England) Regulations 2024 specify what this means in practice.
Three requirements matter most for building managers:
- An electronic facility — your records must be stored digitally in a system that supports controlled access and version management
- Accuracy and currency — information must reflect the current state of the building, not a snapshot from when you last had time to update it
- Accessibility — the BSR can request your information at any time, and you must be able to provide it in a format they can use
A folder of PDFs on a shared drive doesn't meet these requirements. Neither does a spreadsheet with tabs for different record types. The regulations demand something more structured.
The Five Pillars of a Compliant Audit Trail
A Golden Thread audit trail must demonstrate five things to the BSR:
1. What Information You Hold
Start with a complete inventory of your building safety information. The regulations require you to maintain records across these categories:
- Structural safety — as-built drawings, structural assessments, load-bearing element records
- Fire safety — fire risk assessments, fire door inspection records, compartmentation surveys, alarm and detection system records
- Safety case — your building safety case report, risk assessments, and mitigation measures
- Maintenance — scheduled check records, contractor work orders, completion certificates
- Incidents — mandatory occurrence reports, near-miss records, complaint logs
- Resident information — PEEPs, resident engagement records, communication logs
A building with 40 fire risk assessment actions, 12 contractor relationships, quarterly fire door inspections, and monthly alarm checks generates hundreds of records per year. Each one needs to be traceable.
2. Who Changed It and When
Every modification to your building safety records must be attributable. When the BSR reviews your Golden Thread, they want to see:
- Timestamps on every record creation and update
- Named individuals — not "admin" or "office", but the specific person who made the change
- The nature of the change — what was the record before, and what is it now
This is where spreadsheets fail most visibly. A cell in a spreadsheet can be overwritten silently. There's no automatic record of who changed "In Progress" to "Complete" or when they did it. If a contractor marks an FRA action as done and there's no audit record, that action is unverifiable.
3. What the Previous State Was
Version control isn't optional. When you update a fire risk assessment, the previous version must be preserved — not overwritten. When a contractor uploads a completion certificate that replaces a preliminary report, both versions must exist in the record.
Why? Because the BSR may ask: "What was the state of this building's fire safety on 15 January?" If you've been overwriting records, you can't answer that question. With proper version control, you can reconstruct the building's compliance state at any point in time.
4. That Records Haven't Been Tampered With
The accountable person is personally responsible for the accuracy of Golden Thread information. If records can be silently deleted, backdated, or altered without a trace, the entire audit trail is undermined.
A compliant system must make it impossible — or at least detectable — for records to be modified without leaving evidence. This means:
- Deletion protection — records can be archived or superseded, but not silently removed
- Change logging — every modification creates an immutable log entry
- Access controls — only authorised individuals can modify specific record types
Consider the scenario: a fire door inspection reveals defects, but the record is later changed to show a pass. Without tamper protection, there's no way to detect this. With it, the original finding is preserved alongside any subsequent changes, with timestamps and attributions on both.
5. That You Can Produce It on Demand
Under Section 89 of the Building Safety Act, the BSR can request your building safety information at any time. You need to provide it in a format that's:
- Complete — all required categories covered
- Organised — logically structured, not a data dump
- Current — reflecting the building's state as of the request date
- Verifiable — demonstrating the audit trail behind each record
If producing your Golden Thread requires someone to spend three days assembling documents from email threads, shared drives, and contractor filing cabinets, you're not meeting the "accessible" requirement.
Compare Brocade to spreadsheet tracking →
Common Audit Trail Failures
Based on how the BSR approaches building assessments, here are the patterns that raise red flags:
The "Filing Cabinet" Approach
What it looks like: Documents stored in folders (digital or physical) with no linking between them. An FRA sits in one folder, the action plan in another, contractor certificates in a third.
Why it fails: The BSR doesn't just want to see that you have a fire risk assessment. They want to trace from the assessment → to each action → to the contractor assigned → to the evidence of completion → to the sign-off. If those records exist in isolation, you can't demonstrate the chain.
The "Spreadsheet Tracker"
What it looks like: An Excel file with columns for action items, due dates, status, and perhaps a notes field. Maybe a separate tab for each FRA action category.
Why it fails: No automatic audit trail. No version control. No access management. No evidence attachment. The spreadsheet tracks that an action exists — it doesn't prove the action was completed, by whom, with what evidence, and verified by which responsible person.
A building with 35 completed FRA actions needs 35 evidence chains. Each chain links the original finding → the action taken → the evidence uploaded → the date completed → the person who verified it. A spreadsheet with "Complete" in column F doesn't provide any of this.
The "Email Thread" Archive
What it looks like: Contractor updates, inspection reports, and completion certificates scattered across email inboxes. "I know it's in an email from the contractor in September."
Why it fails: Emails are not searchable building records. They're not linked to specific actions. They can be deleted. And when the person who received them leaves, the institutional knowledge goes with them.
Building Your Digital Audit Trail: A Practical Migration Path
If you're currently using spreadsheets, shared drives, or email, here's how to transition to a compliant digital audit trail.
Step 1: Audit What You Have
Before choosing a system, understand your current state:
- List every type of building safety record you maintain
- Note where each record type currently lives (spreadsheet, shared drive, email, paper)
- Identify gaps — which required record categories have no records at all?
- Count the volume: how many FRA actions, contractor relationships, scheduled checks?
Step 2: Choose a Purpose-Built System
Generic document management tools and property management platforms weren't designed for Golden Thread compliance. Look for a system that provides:
- Automatic audit trails on every record change
- Version control that preserves history without manual effort
- Evidence linking — the ability to attach photos, certificates, and reports directly to the actions they evidence
- Access controls — role-based permissions so contractors, managers, and residents see only what they should
- BSR-ready exports — the ability to produce your Golden Thread in a format the regulator can review
The Building Safety Act 2026 update confirms that the BSR is increasing its enforcement capacity. The window for "we'll get to it eventually" is closing.
Step 3: Migrate Priority Records First
Don't try to migrate everything at once. Start with the records the BSR is most likely to request:
- Fire risk assessments and their action plans
- Safety case report and supporting risk assessments
- Scheduled check records — fire alarms, emergency lighting, sprinklers
- Mandatory occurrence reports
- Contractor qualifications and insurance certificates
Step 4: Establish Ongoing Processes
The Golden Thread is only compliant if it stays current. Set up processes for:
- Same-day logging of inspections and checks
- 24-hour evidence upload after contractor work completes
- Immediate recording of mandatory occurrences
- Quarterly reviews to catch gaps before the BSR does
Step 5: Test Your Audit Trail
Ask yourself: if the BSR requested my Golden Thread tomorrow, could I produce it within 24 hours? Could I trace any individual record back to its source? Could I show who changed what and when?
If the answer to any of these is no, you have more work to do.
Book a demo to see how Brocade tracks this →
The Cost of Waiting
The BSR became a standalone body in January 2026, separating from HSE with a mandate for more assertive enforcement. Gateway 2 data shows 108 decisions in 12 weeks, with remediation applications averaging 18 weeks.
The penalties for non-compliance are not theoretical. Under Section 99 of the Building Safety Act, failure to comply with a compliance notice is a criminal offence. The BSR has the power to issue these notices if your record-keeping doesn't meet Golden Thread requirements.
Building managers who start now — even with imperfect records — are in a far stronger position than those who wait for a compliance notice to force their hand.
Questions
What records must be included in the Golden Thread?
The Golden Thread must include fire risk assessments, structural safety information, safety case reports, maintenance records, as-built drawings, contractor qualifications, mandatory occurrence reports, and resident engagement records. The Higher-Risk Buildings (Keeping and Provision of Information etc.) (England) Regulations 2024 specify the categories of information that must be maintained digitally.
How do I create an audit trail for building safety records?
An audit trail requires every change to building safety information to be timestamped, attributed to a named individual, and preserved as a historical record. Use a system that automatically logs who changed what and when, stores previous versions of documents, and prevents records from being silently deleted or altered.
Can I use a shared drive for Golden Thread records?
A shared drive alone does not meet Golden Thread requirements. The Building Safety Act requires an electronic facility with controlled access, version management, and the ability to demonstrate who accessed or changed information. Shared drives lack automatic audit trails, granular access controls, and tamper protection.
What happens if the BSR asks to see my Golden Thread records?
Under Section 88 of the Building Safety Act 2022, the Building Safety Regulator can request your building safety information at any time. You must be able to provide it in an accessible format. If your records are incomplete, disorganised, or cannot demonstrate an audit trail, the BSR can issue a compliance notice under Section 99.
How often should Golden Thread records be updated?
Golden Thread information must be kept up to date as changes occur. Fire risk assessment actions should be updated as work completes. Maintenance records should be added within 24 hours. Document versions should be updated whenever information changes. The key principle is that the Golden Thread reflects the current state of the building at all times.
Further Reading
- Golden Thread guide — comprehensive reference for Golden Thread requirements
- Spreadsheets Are Not a Golden Thread — why spreadsheets fail the Golden Thread test
- Building Safety Case guide — how your safety case connects to the Golden Thread
- BSA compliance checklist — full checklist of your obligations
This guide is for informational purposes. For building-specific advice, consult a qualified fire safety professional.