Proportionate assurance is not the smallest review that can be commissioned. It is the minimum credible scrutiny needed to protect the consequence of a client decision.
Key judgement
Too little leaves material claims untested. Too much creates a second delivery structure, increases cost and can weaken accountability.
The operational problem
Review scope is often based on programme budget, available time or a standard checklist. Those factors do not define exposure. A smaller payroll change can threaten critical operations. A large programme may need only a focused review where strong controls and independent client capability already exist.
Proportionality should be determined by decision consequence, evidence uncertainty, supplier reliance, control maturity, complexity, time remaining and the client’s assurance capacity.
Seven proportionality factors
| Factor | Lower intensity | Higher intensity |
|---|---|---|
| Consequence | Reversible with contained impact | Critical operations or irreversible commitment |
| Evidence | Current, traceable and consistent | Missing, contradictory or filtered |
| Supplier reliance | Strong client-held source evidence | Supplier controls evidence and interpretation |
| Control maturity | Established and demonstrably operating | New, unstable or repeatedly bypassed |
| Complexity | Few interfaces and bounded dependencies | Multiple suppliers, integrations or migrations |
| Time pressure | Options and remediation time remain | Decision window or contingency closing |
| Client capability | Independent specialists have capacity | No assurance team or material skills gap |
Four assurance levels
| Level | Suitable use | Output |
|---|---|---|
| Targeted challenge | One claim or concern with contained consequence. | Short confidence note with evidence gaps or conditions. |
| Decision review | Material gate, investment, acceptance or go-live. | Bounded opinion, findings and decision conditions. |
| Health and viability review | Connected concerns across workstreams. | Integrated viability opinion and prioritised intervention. |
| Staged assurance | Repeated high-consequence decisions in complex delivery. | Evolving confidence, independent escalation and closure verification. |
Scoping mechanics
1. Define consequence
2. Assess uncertainty
3. Select domains
4. Set evidence depth
5. Fix review window
Follow the decision across boundaries
A go-live review may need migration and cutover evidence, quality evidence and operational evidence without reassessing every programme control. A recovery review may focus on schedule logic, capacity, supplier commitments and governance, adding technical depth only where those claims depend on it.
Choose evidence depth
Use defensible sampling where the population is controlled. Examine the full set where a small number of critical items determine the outcome, such as unresolved critical defects, decision triggers or material reconciliation exceptions.
Commissioning decision table
| Question | If no | If yes |
|---|---|---|
| Is the decision and consequence clear? | Clarify the mandate. | Identify claims that must be true. |
| Do existing controls provide reliable evidence? | Increase direct evidence work. | Reuse and test the records. |
| Is client challenge independent and capable? | Add specialist coverage. | Avoid duplicating competent controls. |
| Could one domain invalidate the decision? | Use risk-based sampling. | Examine that domain to sufficient depth. |
| Will findings remain actionable? | Reconsider timing or state limitations. | Fix the review and closure window. |
Stopping rules
- Expand when evidence reveals a connected systemic failure.
- Narrow when reliable controls already answer the decision question.
- Stop collecting when more volume will not change the judgement.
- Do not compress below the depth needed to test a material claim.
- Where time prevents sufficient work, report Insufficient Evidence rather than imply confidence.
Application by client context
| Context | Assurance focus |
|---|---|
| Central Government | Evidence for SRO and programme board decisions, multi-supplier dependency, major approvals and public accountability. |
| Local Government | Citizen service continuity, supplier challenge and proportionate scrutiny without creating a permanent council function. |
| SME | Protection of investment and operations where the technology supplier holds most technical knowledge and evidence. |
The consequence for client governance
The supplier remains responsible for delivery and for producing the evidence behind its claims. The client retains accountability for approval, acceptance and residual risk. Enigma’s independent assurance method gives that client a defensible basis for deciding what to rely on, what to condition and when to intervene.
Related Enigma framework pages
Independence boundary
No practitioner independently assures delivery that they directly own. Delivery support, management action and independent verification must be separated and disclosed.