Every mature contracting function has a delegation of authority matrix. It states who may sign what, at which value, with which approvals, and it is enforced because the finance and audit functions insist on it. That matrix governs exactly one side of the agreement. On the other side, a name appears in a signature block, an e-signature envelope completes, and the file closes.
For most transactions that is fine. Commercial parties generally intend to be bound and courts are reluctant to let a company disown a deal its own employee signed and then performed. The exposure concentrates in a narrower set of cases: high-value or long-term commitments, agreements with entities inside complex group structures, deals signed by someone whose title does not suggest authority, and arrangements with newly formed or thinly documented counterparties.
The practical failure is rarely a forged signature. It is a contract executed by the wrong legal entity in a group, a signatory whose delegated authority lapsed, or a document signed by a person whose email address nobody checked against the domain of the company they claimed to represent. Each of those is cheap to catch at intake and expensive to argue about later.
What actually goes wrong at execution
These are the recurring patterns, and none of them require bad faith on the other side. They are ordinary process gaps that surface when someone needs to enforce the agreement.
- Wrong entity in the group, the operating company performs, the signature block names a holding company with no assets, and the recovery route disappears.
- Lapsed delegated authority, the signatory held a power of attorney that expired or was narrowed, and nobody re-checked because the relationship felt established.
- Title without authority, a regional director signs a global commitment their internal matrix never permitted, which becomes the counterparty defense later.
- Unverified email identity, the envelope goes to a personal address or a lookalike domain, and the audit trail proves only that someone with that inbox clicked.
- No retained evidence, somebody did check the board resolution, but it lives in an email thread rather than in the contract record, so the check cannot be shown.
The remedy is not to demand a certified resolution for every purchase order. That would stall the business and it would be ignored within a quarter. The remedy is a tiered control that asks for proportionate evidence and records what was checked, in the same place the executed document lives. Where intake already captures structured metadata, the authority fields belong alongside it, which is why a coherent contract metadata model matters more than a new checklist.
Entity verification asks whether the legal person named is the one you intend to contract with. Authority verification asks whether the individual may bind that person. Signing-event verification asks whether the human who completed the envelope is the individual you verified. Teams that collapse these into a single review consistently miss the entity question, which is the one that determines whether there is anything to recover against.
A proportionate control set for counterparty execution
Each control below is designed to be answerable in minutes at the tier where it applies, and to leave an artifact behind.
- Entity confirmation at intake. Capture the full legal name, registration number and jurisdiction as structured fields, and confirm them against a registry extract or the counterparty’s own filings rather than against a logo on a letterhead.
- Authority evidence keyed to tier. Low tier accepts a signed representation of authority in the agreement itself. Mid tier adds a delegated authority extract. High tier requires a board resolution or power of attorney with an expiry date recorded.
- Signature block discipline. Require name, title, entity and date in a fixed order, and reject envelopes where the title is blank or the entity differs from the party named in the preamble.
- Identity binding in the envelope. Send to a corporate domain address, enable the identity checks your e-signature platform supports at the relevant tier, and retain the completion certificate with the contract.
- An authority register with expiry dates. For counterparties you sign with repeatedly, hold the verified signatories and the dates their authority lapses, and re-verify on that schedule rather than on instinct.
A five-step roadmap for tightening counterparty execution controls
Step 1, Tier the portfolio by consequence of unwinding
Set two or three tiers using value, term length and how hard the arrangement would be to reverse. A multi-year committed spend with a new entity is a different problem from a one-off order with a long-standing supplier, and the control should say so explicitly.
Step 2, Add entity fields to intake and make them required
Legal name, registration number and jurisdiction become structured fields captured before review, not text typed into a preamble at the end. This single change catches most wrong-entity errors, because the mismatch becomes visible rather than buried in prose.
Step 3, Define the evidence each tier requires
Publish a one-page table naming the acceptable artifact per tier. Reviewers should never have to judge whether a document is sufficient, and the counterparty should be able to see what will be asked before the deal reaches signature.
Step 4, Configure the e-signature workflow to match the tier
Corporate-domain routing at every tier, stronger identity verification at the top tier, and completion certificates retained automatically. The point is that the platform enforces the tier rather than a reviewer remembering it.
Step 5, Hold an authority register and re-verify on a schedule
Record verified signatories, their scope and their expiry dates, and drive re-verification from those dates. For repeat counterparties this converts an unbounded diligence task into a small periodic one.
See execution controls inside the contract record
Entity fields, tiered authority evidence and completion certificates held with the agreement rather than scattered across inboxes.
Why this belongs in intake, not in a pre-signature scramble
Authority questions are cheapest to resolve at the beginning of a negotiation and most expensive at the end. Asking for a delegated authority extract during the first week reads as ordinary diligence. Asking for it the afternoon a quarter closes reads as an obstacle, and it is the moment a commercial owner will push to waive the control. Moving the check into intake also changes who does it. Entity verification against a registry is a structured, low-judgment task suited to an operations team or an automated lookup, whereas the same work performed by a reviewer under deadline pressure becomes a judgment call under stress. Teams that make the fields mandatory at intake report the same second-order benefit: counterparty master data improves, because the legal entity is captured once, in one format, and reused across every subsequent agreement and every downstream report. The same intake discipline underpins supplier contract automation more broadly.
Evidence by tier
The table below shows one workable configuration. The thresholds matter less than the fact that they are published and that each tier names a specific artifact.
| Tier | Typical trigger | Authority evidence | Retained artifact |
|---|---|---|---|
| Standard | Routine spend, short term, known counterparty | Authority representation in the agreement | Executed document and completion certificate |
| Elevated | Material value or multi-year term | Delegated authority extract naming the signatory | Extract with date, stored on the contract record |
| High | Committed spend, new entity or complex group | Board resolution or power of attorney | Resolution with expiry, plus registry extract |
| Group structures | Parent and operating entities both involved | Confirmation of which entity performs and pays | Entity chart and signed acknowledgement |
| Repeat counterparty | Framework or master agreement in place | Entry in the authority register | Register record with re-verification date |
Counterparty signatory verification is unglamorous and it is one of the few contract controls where the cost of doing it well is measured in minutes and the cost of skipping it is measured in unrecoverable claims. The discipline is not heavier diligence on every deal. It is three separable checks, a published tier table, evidence stored on the contract record rather than in a mailbox, and an authority register that turns repeat counterparties into a scheduled task. Organizations that already enforce an internal delegation matrix have most of the thinking done. The work is extending the same logic to the side of the page they do not control.
For related guidance, see How to build a clause library your legal team trusts, When the order form and the MSA disagree and How to review third-party paper contracts.
