Sign-off separate from implementation Whoever builds a platform should not sign off its performance
I hold a simple rule: whoever delivers a piece of work does not check it themselves. In quality assurance, this has long been common practice. For website performance, projects show a different picture: often the team that built the platform also measures load time, chooses the measurement method and reports the result. That is not a question of honesty, but a question of structure.
This position concerns me directly, because my work consists of exactly this separate role: setting target values, measuring, signing off. I therefore disclose what the rule is based on and where its limits lie.
Four-eyes principle and independent verification: standard practice in quality assurance
The four-eyes principle is taken for granted in many areas: a payment is not released by the person who created it, and a code change is not reviewed by its author. Software testing has turned this into a term of its own. The ISTQB defines independence of testing as a separation of responsibilities that encourages objective testing (ISTQB Glossary).
NASA's program for independent verification and validation shows how far this separation can go. It distinguishes three levels: technical independence, because the reviewers are not involved in development; managerial independence, because the review team decides itself what, how and when it checks; and financial independence, because the review budget is not controlled by development (NASA IV&V Overview).
A website is not a space probe, and no relaunch needs a review program of that size. But the three levels work well as test questions for any performance sign-off: Is the party signing off involved in the implementation? Does it set the yardstick itself? Does its budget depend on the result it assesses?
Conflict of interest at agencies: whoever measures their own work also picks the yardstick
An agency that signs off its own implementation faces a conflict of interest, even if everyone involved acts in good faith. It shows in decisions that are technically defensible and still lean in one direction:
- Measurement happens in the lab instead of the field, because the result is available immediately and usually looks better.
- Measurement happens on desktop or on the detail page, where values are good, not on the homepage with all its campaign modules.
- Measurement happens before the tags are added, because tags are not part of the agency's own scope.
- Missed values are attributed to editorial content, without anyone checking whether the component allows that in the first place.
None of these points requires intent. Pressure on deadlines and budget is enough. Whoever needs the sign-off to close the project has little reason to look for a measurement error at their own expense. This applies to every agency and every in-house team alike.
Independent sign-off against target values: set the yardstick first, check the result afterwards
An independent sign-off does not start at the end of the project, but before it. Its most important contribution is the yardstick: target values per page type and market, measured at the 75th percentile of field data, defined before implementation begins. After that, every release follows the same process: a lab pre-check against the performance budget, proof in the field after go-live and a report with measured value, target value and source per page type. Because the yardstick is fixed in advance, it cannot be adjusted to the result afterwards. Missed values become tickets with an acceptance criterion. The templates are available in the Core Web Vitals acceptance criteria.
The separation also helps in finding the cause. In the separate crawl of the AEM Core Web Vitals Benchmark, the server already responds too late for 80.3 percent of the websites with slow main content, and in the Magnolia benchmark for 78.8 percent. Whoever is responsible for only one part of the chain mainly sees that part. A party with no share in the implementation can ask without bias whether the problem arises in the cache, in delivery or in the browser.
Independence needs fixed rules: no commission, no implementation, no preferred agency
Independence remains a claim as long as it is not tied to rules. My work is therefore subject to the same rules as stated on the pages for agencies: no commission and no referral fee in either direction, no stake in any implementation partner, no preferred agency and no implementation in the same project. All partners are signed off against the same criteria, and implementation stays entirely with the operator's team or its agency.
These rules correspond to the three levels from quality assurance: no involvement in implementation, a yardstick that is fixed before implementation, and no financial interest in a particular result. Verifiability comes on top: the report names the source and period for every value, so that operator and agency can re-measure every statement themselves.
Working with agencies: clear criteria instead of disputes over scores
An independent sign-off is not competition for the agency. It fills a role that is often missing on the operator's side, and the agency in particular benefits from it:
- If the requirements contain a target value, performance becomes paid work instead of unpaid rework after go-live.
- If the agency itself asks for a performance budget, it looks like self-interest. If the evidence comes from field data and from outside, the budget is released more easily.
- Acceptance criteria that are fixed before implementation end the debate over scores that vary from run to run.
Independence also has costs. Someone who is not part of the project knows the code and the business constraints less well, and a reviewing party can slip into an adversarial role. I counter both with three habits: I work in the project's ticket system, answer questions from the development team and agree on target values together with the operator and the agency. What this looks like for implementation partners is described in Performance partner for AEM agencies and Performance partner for Magnolia agencies.
Sign-off by the operator itself: independence depends on the role, not the letterhead
Not every platform needs an external party. A team on the operator's side that is not involved in the implementation, sets the yardstick in advance and has access to the field data can take on the sign-off just as well. It becomes difficult when the same person writes the requirements, steers the implementation and finally confirms the result under the pressure of a go-live date. In that case, I consider an external sign-off the more honest solution. The complete process with target values per page type is described in Website Performance Optimization.
Book a free performance analysis
30 minutes by video. You receive Google's real-user data for your platform compared with two competitors, regardless of whether we work together.
Frequently asked questions about independent performance sign-off
Is an independent sign-off a vote of no confidence in the agency?
No. It separates roles, not trust. The agency implements, another party checks against target values that are fixed in advance. For the agency, this means clear criteria instead of a debate over scores, and performance as paid work instead of rework after go-live. More in Performance partner for AEM agencies.
Can the performance sign-off sit with the operator itself?
Yes, if the party signing off is not involved in the implementation, sets the yardstick before implementation and has access to the field data. It becomes difficult when the same person writes the requirements, steers the implementation and confirms the result.
What does a performance sign-off report contain?
For each page type and device, the measured value, the target value, the source and the measurement period, plus the result and, for every deviation, a ticket with an acceptance criterion. Templates are available in the Core Web Vitals acceptance criteria.