Anonymised composite case study
This case study draws together recurring patterns encountered across complex third-party technology programmes. It does not identify a single client, supplier or individual.
A public-service organisation had appointed a prime supplier to deliver a major platform transformation. Governance packs showed broadly positive progress, milestones continued to be reported as achievable and each workstream maintained its own plan. The programme board had extensive reporting but no independent view of whether the evidence supported the position being presented.
The problem
The supplier owned delivery planning, status consolidation, test reporting and the recommendation to progress. Client teams attended governance meetings, but their decisions depended on information prepared and interpreted by the organisation responsible for achieving the date.
The issue was structural rather than personal. Capable people were working hard, but the reporting model blurred three different questions: what activity had occurred, whether contractual outputs were complete, and whether the client could safely accept the resulting risk.
What the evidence showed
- Exit criteria had been reinterpreted after delivery pressure increased.
- Reported completion percentages did not reconcile to accepted deliverables.
- Test progress was visible, but traceability from critical business risks to executed evidence was incomplete.
- Several defects described as low severity had a combined operational consequence that had not been assessed.
- Recovery actions were reported as mitigation before they had produced verified results.
- Client-side risk acceptance lacked explicit owners, limits and expiry conditions.
None of these points alone proved that delivery would fail. Together, they meant the programme board could not defend its confidence using the evidence available.
The assurance intervention
Enigma established a client-side assurance boundary. The supplier retained responsibility for delivery; the client retained responsibility for acceptance; assurance tested the evidence between them.
The intervention concentrated on five controls:
- Decision definition. Each governance point was restated as an explicit decision with clear evidence requirements.
- Source-evidence review. Status statements were traced back to plans, acceptance records, test results, defects, dependencies and accountable owners.
- Common criteria. Workstreams were assessed against consistent definitions of complete, accepted, blocked and at risk.
- Independent findings. Contradictions and omissions were recorded with consequence, ownership and the evidence required for closure.
- Controlled acceptance. Exceptions were converted into time-bound conditions rather than absorbed into narrative reporting.
What changed
The programme board stopped treating the supplier dashboard as the assurance conclusion. It received a separate view distinguishing verified fact, reasonable inference, unsupported assertion and unresolved exposure.
Milestones were no longer accepted because activity had occurred. They were accepted when agreed outputs and controls could be evidenced. Where evidence remained incomplete, the board either imposed explicit conditions, held the decision or accepted the risk on the record.
The supplier also benefited. Evidence requests became predictable, disputed interpretations were resolved against agreed criteria and recovery actions could be closed once their effect was proven.
The outcome
The immediate outcome was not a manufactured green status. It was restored client control. Leadership gained a defensible view of delivery confidence, the supplier retained clear accountability for delivery and material risk reached the correct decision-makers without being softened by the delivery hierarchy.
The wider lesson is simple: more reporting does not correct a lack of independence. A client needs its own evidence standard, direct access to source material and a route for findings to reach governance unchanged.
Enigma provides supplier delivery assurance and applies its Evidence Sufficiency Standard to the decisions that matter. To define an assurance mandate, use the assurance contact route.