Case study: How a Single Mis-Rated Data Point Can Undo a Managing Agent’s Building Safety Act Compliance

A worked example of how third-party data errors travel silently into a building’s safety record — and what that means for compliance, enforcement and insurance if nobody catches them.

At a glance

The challenge A gas utility emailed a managing agent confirming five blocks of flats as “Low risk.” Buried in that email: a duplicated record masking a block that may never have been assessed, and an inspection date five years old, with defects that were never resolved.

The solution Complitas’ CompliScore engine cross-referenced the same building against fire, structural and evidence records, independently of the single-contractor summary. It rated the block High risk.

The business impact Caught early, this is a data-quality footnote. Missed, it’s an unlimited fine, up to two years’ imprisonment for the Accountable Person, and grounds for an insurer to void the building’s cover entirely, regardless of how any incident occurs.

The problem: safety data you didn’t generate, but are legally accountable for

Managing agents don’t produce most of the safety data they rely on. Gas engineers, fire risk assessors, lift maintainers, electricians and water hygiene contractors all feed information upward, and the Accountable Person is expected to assemble it into a single, defensible safety case: the Golden Thread the Building Safety Act now requires.

This case study uses a real, anonymised exchange between a gas utility and a managing agent to show how easily that inbound data goes wrong — and how, without independent cross-referencing, the error stays invisible to the people legally accountable for it.

A managing agent cannot manage a risk it has never been shown. An unknown unknown doesn’t fail an audit, it fails a resident, an insurer, or a regulator, at the exact moment there’s no time left to fix it.

This isn’t rare. A 2026 report by GS1 UK and Barbour ABI found fragmented, hard-to-share construction data costs the UK industry up to £3.8 billion a year, and that 98% of construction professionals know the Building Safety Act exists, yet only 21% feel prepared to meet it. Separate research found roughly 32% of UK project data is “bad,” and bad data drives poor decisions around 31% of the time. This case study is that mechanism in miniature: one bad record, in one email, sent an entire building’s risk rating in the wrong direction.

The evidence: one email, six records, two errors

A gas utility’s engineering team emailed a managing agent confirming risk ratings for six block records covering one estate. Five were marked “Low risk,” one “Medium risk” — a reassuring, mostly-green summary.

Look closer, though. There are six rows but only five distinct block ranges: “26 to 46” appears twice, identically, against the same postcode. Neither entry is linked to a separate inspection date or engineer reference. That’s not a second, corroborating check, it’s the signature of a duplicated export line, and nothing in the email distinguishes an innocent copy-paste slip from a genuine gap in the record.

One block in six arrived as a data integrity problem before a single valve had been inspected.

What the underlying report actually said

The “Low risk” line traced back to a Gas in Multi-Occupancy Building Inspection Report last completed 06 August 2021, five years before the email restated it, with no inspection date shown and no signed confirmation any remedial work was completed. Read in full, that report already recorded:

• Housekeeping — combustible materials stored in riser cupboards, first flagged in 2019 and still present in 2021.
• DSEAR — gas pipework and electrical cables sharing the same space, failing the required 25mm separation under the Dangerous Substances and Explosive Atmospheres Regulations 2002.
• Compartmentation — gas risers not sleeved between floors, giving fire or gas escape an unobstructed route from one level to the next.
• Service entry point — the point where the gas main enters the building recorded as not suitably sleeved and sealed, with responsibility defaulted to the managing agent on the utility’s own template.

None of these were hypothetical. They were the utility’s own findings, sitting in its own report — three weeks before an independent audit reached the same address.

What an independent audit found at the same address

Three and a half weeks after the utility’s email, Complitas generated an independent Building Safety Management Pack for the same site. Where the gas utility’s own inspection (five years old) said Low, CompliScore said High.

CompliScore doesn’t repeat whatever the most recent contractor report says. It cross-references submitted evidence against the checks a building is actually required to complete, converting the result into a single quantitative score and a portfolio-comparable RAG status. In this case: 71 checks completed, 14 evidence appendices attached, and 21 items of evidence still outstanding — a compliance gap a single-source “Low risk” email gave no visibility of whatsoever.

Placed side by side, the two assessments of the same building can’t both be treated as authoritative. The utility’s rating wasn’t necessarily wrong on its own terms — it may have been an accurate snapshot of gas-specific risk back in August 2021. But a managing agent receiving that rating restated in a 2026 email, with no inspection date attached, has no way of knowing how old the assessment really is. A single-discipline rating filed without cross-reference is indistinguishable from a building that was safe five years ago — which is not the same thing as safe today.

Why this matters: the Building Safety Act 2022

The Act substantially raised the stakes for getting this wrong. Section 83 requires an Accountable Person to assess building safety risk as soon as reasonably practicable; section 84 requires that assessment be kept under review — a duty the Building Safety Regulator now expects to be met with evidence, not narrative assurance from a single contractor.

• Non-compliance, once a summary offence capped around £5,000, now carries an unlimited fine and/or up to two years’ imprisonment.
• The enforcement window runs 10 years after the relevant works were completed — a mis-filed defect from years ago remains prosecutable today.
• Directors, managers and “similar officers” can be personally prosecuted.
• Daily fines can continue to accrue after conviction for each day non-compliance goes unresolved.

None of this requires proof of intent. A defect that was never correctly reported — because it arrived duplicated, was filed under the wrong block, or was accepted at face value without cross-referencing — is treated the same as one deliberately ignored.

The insurance trap

Buildings insurance is underwritten on a “fair presentation of the risk.” A mis-categorised or unreported defect breaks that presentation three ways:

• Material misrepresentation — if the risk register says “Low risk, gas confirmed” and the true position is a duplicated, unverified record with 21 outstanding evidence items, the insurer was underwriting a different building to the one that actually existed.
• Failure to disclose a known defect — once any part of the organisation has seen a rating flagged as inconsistent, that knowledge is generally treated as the policyholder’s, whether or not it reached the right person.
• Breach of warranty or condition — a live Building Safety Act breach can trigger compliance clauses independently of the incident being claimed for.

In practice, a fire, gas explosion or structural failure claim can be reduced or refused outright — not because the incident was uninsurable, but because the information the policy was built on was wrong. That risk lands on leaseholders too: a declined claim can leave them exposed to rebuilding costs, and can itself trigger a professional negligence claim against the managing agent.

Where the failure actually happens

Nobody acted dishonestly here. A contractor’s spreadsheet export duplicated a row; the duplicate went out alongside five genuine records; the recipient reasonably took the summary line at face value; the email was filed as evidence of compliance; and no one revisited it until an entirely separate audit reached a different conclusion.

Every step was individually defensible. That’s the unknown unknown problem: the building still ended up with a live, unresolved compliance and insurance exposure that nobody set out to create.

How independent verification closes the gap

A purpose-built compliance platform doesn’t replace the specialist contractor’s assessment, it centralises it, structures it, and checks it against everything else known about the building before anyone relies on it.

• Centralised documentation — cross-referencing gas, fire, electrical, structural and lift data against one shared building record, instead of filing each contractor’s report in isolation.
• Golden Thread support — surfacing duplication and inconsistency automatically as records are added, rather than relying on a human to spot a repeated row months later.
• Quantitative, evidenced risk rating — a single RAG-banded score with a clear audit trail, so “Low risk” means the same thing every time, across every building in a portfolio.
• Accountability assignment — one shared, defensible record for the Accountable Person, the freeholder and the insurer alike.

This doesn’t remove the underlying duty, the Act places responsibility with the Accountable Person, not with any software. What it changes is whether an error like this is caught in week one, while it’s still a data-quality footnote, or in year three, when it surfaces as a failed insurance claim or a BSR compliance notice.

Conclusion

The most dangerous line in this case study isn’t the one marked “Medium risk.” It’s the reassuring one: “these are all Low risk.” A summary like that closes the loop for a busy managing agent, it feels like the end of the task, not the start of a question.

Until the two assessments were placed side by side, nobody managing this building had any way of knowing it wasn’t low risk at all. Closing that blind spot, through a centralised, evidence-based Golden Thread rather than single-source trust, is the difference between an unlimited fine and a voided insurance claim on one hand, and a building that’s genuinely inspection-ready on the other.

Note on this case study: all names, job titles, personal email addresses and company branding in the source correspondence have been redacted to comply with data protection requirements. References to BS 8313:1997 and IGEM/G5 Edition 1 are paraphrased for brevity — current copies should be purchased directly from BSI (bsigroup.com) and IGEM (igem.org.uk) before being relied upon. Figures on Building Safety Act 2022 penalties reflect the general enforcement regime at time of writing and are not a substitute for legal advice on a specific case.

Since the defects described in this case study were identified, the managing agent has been actively working through each of them — engaging specialist contractors to address the compartmentation, DSEAR and housekeeping issues, and pursuing the utility provider for clarity on the service entry point and underlying installation records. It is the managing agent’s position that it is taking all reasonable steps to manage the risk in the interim and rectify outstanding defects on a prioritised basis, consistent with its duties as the building’s Accountable Person under Section 83 of the Building Safety Act 2022.