An independent assurance review should be commissioned around a decision, not around a vague request for a health check. The commissioning organisation must define what decision needs to be supported, what evidence will be available, who owns the delivery being examined and how the assurance provider will remain independent of that delivery.
Enigma sits on the client’s side of the table. The purpose of the review is to give the client a defensible view of delivery confidence, evidence gaps, material risks and the conditions that should apply to the next decision. It is not to repeat supplier reporting, provide temporary programme management or give an opinion on work that Enigma directly owns.
Start with the decision
The first commissioning question is not “What should the reviewer examine?” It is “What decision must the organisation make?” Typical decisions include:
whether a programme should proceed through a governance gate;
whether a supplier’s reported status is credible;
whether a recovery plan is capable of restoring delivery confidence;
whether testing, migration, cutover or operational readiness is sufficient;
whether a go-live decision can be defended using the evidence available;
whether further investment remains proportionate to the likely outcome.
A review with no defined decision tends to produce a long list of observations. A review commissioned around a decision can distinguish information that is interesting from evidence that is necessary.
Define a clear assurance question
The assurance question must be capable of being answered through evidence. “Is the programme healthy?” is too broad. Better questions include:
Is the evidence sufficient to support the supplier’s current delivery status?
Does the recovery plan address the causes of delay and provide a credible route to the required milestone?
Is the programme ready to enter user acceptance testing?
Does migration evidence demonstrate completeness, accuracy and reconciliation at the required level?
Are the residual risks understood and acceptable before go-live approval?
The question should state the decision point, the required date and the organisational authority that will receive the opinion. Where several decisions are involved, they should be separated rather than concealed within one broad scope.
Set the Assurance Mandate before evidence collection starts
The commission should define:
the decision to be supported;
the scope and explicit exclusions;
the review period and reporting date;
the evidence Enigma may request;
access to programme, supplier and governance personnel;
the independence and conflict boundary;
the rating and finding conventions to be used;
how factual accuracy checks will operate;
who receives the draft and final opinion;
how restrictions, evidence refusals and unresolved disagreements will be recorded.
Record the scope in an Assurance Mandate. The related downloadable tool is the Assurance Mandate Template. This mandate is a control. It prevents the scope being narrowed when difficult evidence emerges and prevents the review drifting into delivery work. Enigma’s wider approach to client-side delivery support provides context, but the specific mandate must govern each assurance engagement.
Protect independence explicitly
Independence cannot be inferred from job titles or organisational separation. The commissioner must identify who designed, delivered, managed, approved and reported the work being reviewed.
No individual or organisation should provide the independent assurance opinion where they directly own the delivery outcome under examination. A multidisciplinary review may draw on programme, quality, testing, architecture, migration and agile delivery expertise, but each contributor must remain outside the delivery decision they are assessing.
If Enigma has previously advised on part of the work, the mandate must record whether that creates an actual, potential or perceived conflict. The affected area may need to be excluded, independently reviewed by another party or clearly qualified in the opinion. Independence is not protected by silence.
Commission evidence access, not presentation access
A credible review requires access to source evidence, not only management presentations. The commission should authorise access to relevant plans, decision logs, RAID records, requirements, traceability, test evidence, defect records, architecture decisions, migration reconciliations, cutover rehearsals, operational readiness evidence, supplier commitments and governance minutes.
Evidence should be current, attributable, complete enough for the decision and capable of independent examination. Verbal explanation may provide context, but it does not replace controlled evidence. Existing technical artefacts, such as a test strategy, must be assessed for their actual authority, application and supporting results, not accepted because the document exists.
Specify the required outputs
The commission should require outputs that help the decision-maker act. At minimum, the review output should contain:
the assurance question and scope;
the evidence examined and material evidence not supplied;
the overall confidence rating and its basis;
material findings, their consequence and the decision affected;
conditions that should be met before approval;
residual uncertainties and limitations;
actions requiring closure evidence;
an explicit statement of independence and conflicts.
A slide deck alone may be useful for discussion, but it is not always a sufficient programme record. The required written output should be agreed at commissioning so that the board receives an auditable opinion rather than a meeting impression.
Allow proportionate challenge without creating disruption
Assurance requires programme time, but uncontrolled review activity creates avoidable cost. The commission should establish one evidence coordinator, a structured request log, agreed response dates and focused interviews. Existing material should be reused where it is reliable. New documents should not be manufactured merely to satisfy the review.
Proportionality depends on the consequence of the decision, the degree of uncertainty, delivery complexity, supplier dependence, evidence maturity and time available. A short targeted review may be appropriate for a contained decision. A major approval, recovery or go-live decision may require deeper multidisciplinary examination.
Keep factual accuracy separate from editorial control
The programme and supplier should be allowed to correct factual errors and provide missing evidence within an agreed window. They should not control the assurance judgement, rating, wording of findings or disclosure of limitations.
Disagreement is not evidence that the review is wrong. Where a material disagreement remains, the opinion should record the disputed fact, each party’s position and the evidence used. The commissioning authority then decides how that uncertainty affects the decision.
Agree how findings will be closed
Commissioning must cover closure, not only initial reporting. An action is not closed because an owner says it is complete. The evidence required to demonstrate closure should be defined when the finding is agreed.
Closure may require a revised controlled document, successful test result, approved decision, reconciled dataset, completed rehearsal or independently verified operational control. If the programme changes the proposed treatment, that change should be assessed against the original finding and decision consequence.
Common commissioning failures
Starting with a fixed number of interview days: effort is defined before the decision and evidence need are understood.
Letting the supplier define the evidence pack: the reviewed party controls what the reviewer sees.
Using the reviewer as delivery capacity: independence is compromised and accountability becomes unclear.
Requesting a traffic-light rating without criteria: the board receives colour without a defensible basis.
Suppressing limitations: missing evidence is presented as confidence rather than uncertainty.
Leaving closure outside scope: findings become actions that can be administratively closed without proving risk reduction.
A practical commissioning sequence
Identify the decision and accountable decision-maker.
Frame the assurance question and required date.
Define scope, exclusions and independence boundaries.
Identify evidence domains and access rights.
Agree rating, finding and closure conventions.
Set factual accuracy and disagreement protocols.
Confirm outputs, recipients and governance use.
Mobilise evidence collection through a controlled request process.
Conduct independent examination and challenge.
Issue the opinion with conditions, limitations and closure requirements.
Commission Enigma from the client’s side of the table
Enigma’s role is to examine whether the available evidence supports the decision the client needs to make. The work is structured around programme assurance, quality and testing, architecture, migration, cutover and delivery governance as one multidisciplinary capability.
The engagement must preserve a simple boundary: Enigma can advise, challenge and provide an independent opinion, but it cannot independently assure delivery that it directly owns. Organisations preparing a review can use the Enigma contact route to provide the decision context, required timescale and current delivery structure.
