Six sign-offs, zero accountability: the UAT chain

A cross-vendor change in an enterprise route-to-market stack collects five or six formal UAT sign-offs — one per vendor module, plus the integrator and the business — and still ships with nobody owning whether it works in production. Each signature attests that one module behaved to its own spec, not that the end-to-end outcome holds. That is the accountability inversion: maximum ceremony, zero ownership. The delay it buys is the real cost.

Why does one change need six sign-offs?

Because the stack is drawn along vendor lines, and every vendor warrants only its own box. A single change to how a distributor places a combo order can touch order capture in the CRM, pricing and promotions in the commerce platform, rebate and tax logic in the finance layer, and delivery scheduling in the middleware. Four modules, four contracts, four teams — commonly spread across three time zones. Each vendor runs UAT inside its own environment against its own release train, and only then does the integrator run a separate pass across the seams. The calendars are serial, not parallel: the commerce vendor’s window does not open until the CRM vendor closes its build, and so on down the line. It is the same mechanism that turns a two-day code change into a two-quarter feature, described in how the quarterly release train guarantees quarterly features.

Why does everyone sign but nobody own the outcome?

A UAT sign-off is a liability boundary, not an ownership claim. When the commerce vendor signs, it is asserting that its module returns the correct price for the fields named in its statement of work. It is not asserting that the distributor can actually place the order and see the empties credited correctly two systems downstream. Every party is individually, defensibly correct. The system is collectively broken — and the break lives in the seam between modules, which is exactly where no signature lands.

Here is what the chain actually certifies:

Read the right-hand column and the problem is plain: the one thing that matters to the business — the end-to-end outcome — is the one thing no one has signed for. It is the same defensive reflex documented in why your change advisory board is making releases riskier: governance tuned for who gets blamed rather than whether the change is safe.

What does the chain actually cost?

The public record has a clean example. In March 2017 a major North American brewer sued its systems integrator, HCL Technologies, in federal court in Illinois, seeking in excess of $100 million on an SAP programme whose base contract ran roughly $53 million. At the centre of the complaint sat a dispute over whether the blueprinting phase was actually complete — a boundary argument between two parties — which produced a roughly five-month delay. That delay pushed the brewery deployments into peak season: the blackout window when a beverage business freezes releases because it cannot risk breaking order-to-cash during its highest-volume months. The suit was filed loudly and settled quietly, each side bearing its own costs.

The point is not that a vendor underdelivered; vendors sometimes do. The point is that the sign-off chain does nothing to prevent this outcome. It spreads responsibility so evenly that when the seams fail there is no single owner to escalate to — only counterparties, and the only instrument counterparties have left is litigation.

So the sign-offs are not the safeguard they look like?

No. They are risk theatre. The chain optimises for defensibility, not correctness: each party is incentivised to protect its own boundary, so integration risk — the only risk that can actually take a release down — is precisely the risk no one is paid to catch. And because every signature is a serial dependency, more signers means both more seams to fail and a longer critical path. It is the exact inverse of how high-performing teams work. Elite performers in the DORA data deploy far more often precisely because one team owns a change end to end; the size of that gap is laid out in what elite deployment frequency actually means. Six sign-offs is not six times the safety. It is six times the surface area and one-sixth of the ownership.

The fix is not a better sign-off matrix; it is fewer seams. When order capture, stock, loyalty, returnables, delivery and analytics run on a single event bus owned by one team, a cross-vendor change stops being cross-vendor. There is one environment to test, one owner to sign, and the integration seam that used to belong to no one now belongs to the team that built both ends of it.

A boundary in a stack is not free governance. Each one is a place where accountability leaks out and calendar time leaks in. The platforms that pull ahead over the next few years will not be the ones with the most thorough approval chain; they will be the ones that dissolved the boundaries until there was nothing left to hand off — and one name left on the outcome.