Supplier reporting is necessary, but it is not independent assurance. A delivery supplier is accountable for planning, managing and reporting its work. The client still needs an evidence-based view of whether delivery claims are reliable, obligations are being met and emerging exposure is being controlled.
Enigma sits on the client’s side of the table. We provide independent delivery assurance that tests supplier claims against evidence and translates the result into decisions for SROs, programme boards and accountable leaders. We do not replace supplier management, contract management or delivery leadership. We strengthen the client’s ability to govern them.
The problem: confidence is often built on supplier-generated status
Programme boards can receive regular dashboards, milestone reports, risk logs and recovery plans while still lacking a dependable view of delivery. The reporting may be timely and professionally presented, but it can remain selective, internally graded or disconnected from the evidence needed to support a decision.
The risk is not simply that a supplier is wrong. Different workstreams can use inconsistent definitions of progress, completion and acceptance. Dependencies may sit outside the supplier’s direct control. Quality evidence may lag behind reported build progress. Forecast dates may reflect targets rather than demonstrated throughput. Commercial reporting can also answer a different question from operational readiness.
The control gap
Contract governance establishes obligations and routes for accountability. Delivery governance tracks activity and manages action. Neither automatically gives the client an independent conclusion on whether the available evidence is sufficient, current and decision-relevant.
That gap becomes material when the client has limited internal assurance capability, several suppliers, a critical milestone, disputed status, repeated reforecasting or a recovery plan that has not been independently tested. A programme can be busy and still lack a defensible basis for confidence.
A clear independence boundary
The people responsible for delivery should provide evidence and explain their judgements. They should not provide the final independent assurance conclusion on work they directly own. Enigma separates delivery ownership from assurance so that findings can be reported to the client without supplier incentives, internal hierarchy or delivery pressure determining the answer.
How Enigma assures supplier delivery
Our work follows the evidence-to-decision approach described in How We Assure. The scope is set around the client’s decision, not around a generic document review.
- Frame the decision. We agree what the SRO or board must decide, by when, and what level of confidence is required.
- Establish the baseline. We identify the relevant contractual commitments, approved plans, acceptance criteria, governance decisions and dependency assumptions.
- Request decision-grade evidence. We define a proportionate evidence request and distinguish source records from management interpretation.
- Test the claims. We compare reported status with plans, quality results, technical evidence, delivery trends, risks, decisions and operational constraints.
- Rate confidence and exposure. We explain where evidence supports the claim, where it is incomplete and what uncertainty means for the client.
- Support action and closure. We provide clear conditions, owners and evidence needed to resolve findings, then verify closure where required.
What we examine
Supplier delivery assurance is multidisciplinary. The review team is shaped around the decision and may combine programme direction, programme management, quality and test, agile delivery, technical architecture, data migration and cutover assurance. These are not presented as a catalogue of contractors. They operate as one client-side assurance capability.
- Obligations, deliverables, acceptance criteria and the evidence of completion.
- Integrated plans, critical path, dependencies, resource assumptions and schedule credibility.
- Status definitions, forecast logic, milestone evidence and changes to the approved baseline.
- Quality strategy, test coverage, defects, environments and readiness to accept.
- Architecture decisions, technical constraints, non-functional evidence and unresolved debt.
- Data migration, cutover, operational acceptance, support and rollback readiness.
- Risks, issues, decisions, actions and whether recovery measures address root causes.
Where the main concern is whether the overall programme remains achievable, the work can connect to a programme health check or recovery review. Where reported progress depends heavily on test completion or acceptance, we bring in quality and test assurance.
Evidence required
The evidence request is tailored to the decision and stage of delivery. It commonly includes the approved business and delivery baseline, contract schedules, integrated plan, milestone definitions, dependency records, status packs, RAID records, decision logs, quality and test evidence, architecture decisions, delivery metrics, financial forecasts, acceptance records and recovery actions.
Volume is not the objective. Evidence must be traceable, current, internally consistent and capable of supporting the claim being made. Missing evidence is not automatically proof of failure, but it reduces confidence and must be visible to decision-makers.
Outputs
- An executive conclusion written for the decision the client must make.
- A confidence assessment that distinguishes supported claims from assumptions and unresolved uncertainty.
- Findings linked to evidence, impact and the accountable delivery or client owner.
- Conditions for proceeding, with required actions and closure evidence.
- A focused view of supplier, client and cross-supplier dependencies.
- An evidence trail that can be revisited at the next governance point.
For a practical starting point, download the Supplier Self-Assessment Executive Briefing. Additional checklists and briefing material are available in Resources.
Decision value for the client
The purpose is not to produce another status report. It is to help the client decide whether to proceed, proceed with conditions, intervene, reset expectations, require recovery evidence or commission a deeper review. The conclusion also makes residual uncertainty explicit, so optimism is not mistaken for assurance.
This gives programme boards a firmer basis for challenge, gives supplier leadership a clearer account of the evidence required, and helps contract and delivery governance focus on material exposure. Independence does not remove the need for judgement. It improves the evidence on which judgement is exercised.
Commission supplier delivery assurance
An engagement can focus on one critical decision, a supplier milestone, disputed reporting, recovery credibility or continuing oversight across a delivery phase. We first clarify the decision, timing, supplier landscape, available evidence and independence constraints. We then propose a proportionate review boundary and evidence request.
Discuss a supplier delivery assurance review or download the Independent Delivery Assurance service sheet.