First, if you do not correctly melt (stirring, mixing, observing, correcting), and pour your bars incorrectly, the heavier gold will try to move towards the bottom. A melt has to be one homogenous mass, meaning no dark spots and having a nice uniform color before you pour into a mold. But if you take a mass that has not been melted correctly, and pour it into a mold, in the center lets say, the gold that isn't melted correctly with the rest of the metal will try to travel to the bottom and dependent upon how fast the bar becomes solid, it might or might not make it. So all along the outside of the bar might read lower than the inside. The top might read differently than the bottom. When the top and bottom are drilled and the shavings hit with an XRF gun, you might be getting a of 5 shaving amounts from low content areas, and one shaving reading from the sweet spot in the middle of the bar. And how can you accuse them of ripping you off if they are just testing your bar?
I don't understand the concern over being able to flip a switch on an XRF to read differently. It wouldn't even take that much. When I owned a grocery store I had to constantly watch for people ripping me off using all kinds of different methods. Unfortunately, because I would like to believe everyone is good, my experience has been that if you give someone an opportunity to steal from you, eventually they will. A common way to rip off the store you work for as a cashier is to do what is called sweethearting, selling things for less than their worth, to friends and family. I have seen a lot of sweethearting and some pretty clever ways to do it. I had a 19 year old girl who tapped a barcode under her bracelet and would simply cover the barcode with her hand, and then move her bracelet to scan the barcode on her wrist. Forget about the calibration, if someone wants to rip you off it just takes a small piece of metal, nothing more. By scanning one time, and then a second time, they can get the reading of the actual content, and then force a second reading with another small sample you don't see, and get the reading they want not too far off from your own. This is just a suggestion of how it could be done.
Also, don't forget XRF scanners operate on software, anything that has software can be altered, no switch required.
Third party fire assay is the way to go.
Scott