Locking the form is not going to work for you. You need a field in your
table that determines whether they have been signed off. I recommend a
Boolen(yes/no) field with the default value set set in the table design to
False. Then Signed Off would be true.
Now put a CheckBox control on your form also with a Default value of False
and bind it to the field in your table. Make the Visible property of the
control No.
If the boss uses the same form as the users, then you need a way to make the
control visible only for the boss.
There is an API function at this site
http://www.mvps.org/access/api/api0008.htm
that allows you to determine who the logged on user is.
In the Load event of your form, call this function and if it returns the
boss' network login name, make the check box visible.