The audit certificate and the verify page
Every approved bill gets an audit certificate, a PDF record of who approved it and when, and anyone can check it against our records on a public page, with no login.
What is on it
- the organisation, the document and its lines, without tax, as approved
- the workflow and version it was approved under
- the approval chain: who approved, when, whether in the app, from an email link or by a rule, and the IP address where one was captured
- questions, answers and restarts
- the risk flags, with who acknowledged them and what they wrote
- the supplier's attachments, added to the end or listed by name, size and fingerprint (SHA-256)
- a SHA-256 digest and the verify page address
Where to find it
When the last approver says yes, the certificate is attached to the bill in Xero. In WorkApproved, use Certificate on the bill page. If a bill is approved again after a restart, the new certificate replaces the old one in Xero. WorkApproved keeps every version, marked Replaced by a later certificate.
Check it on the verify page
Each certificate prints an address ending in /verify/ and a certificate number. Anyone can open it, with no sign-in.
If the certificate matches, the page says This certificate matches our records. It shows the document number, organisation, approval date and a digest (SHA-256). If it differs from the digest printed on your copy, your copy does not match our records.
The page may add a note, such as A later certificate replaces this one or The document was changed in Xero after this approval.
This certificate does not match our records means do not rely on it. Ask the organisation for the current certificate. Certificate not found means the address is wrong.
Check a file
On the verify page, Check a file tells you whether a file is one of the attachments the certificate lists. Your file is fingerprinted in your browser and never sent to WorkApproved. You can paste a SHA-256 fingerprint instead.
What it does not do
The check covers the recorded evidence, not the PDF file itself. It is not a digital signature on the PDF. WorkApproved keeps its copies of attachments for 18 months, then deletes them. Their fingerprints stay, so a file you hold can still be checked.
Related
Still stuck? Email [email protected]. This guide is also in the app at go.workapproved.app/help/audit-certificate-and-verify-page.