Independent assurance only has value when it is commissioned against a defined client decision. A request to take a general look creates activity, but it does not create a defensible assurance opinion.
Key judgement
The mandate must state what decision is being supported, which claims are being tested and what evidence the reviewer may access. If those elements are unclear, assurance should not begin.
The operational problem
Programmes often commission assurance after concern has already surfaced. The brief may be framed as a health check, a quick review or a request to confirm that delivery remains green. Those formulations are too weak. They do not establish the decision at stake, the material risks, the evidence boundary or the authority of the reviewer.
A vague mandate also makes the review easier to contain. Evidence can be filtered through the delivery supplier, exclusions can emerge late and the reviewer can be asked to comment on matters that were never properly examined. The resulting report may sound confident while its basis remains uncertain.
Mandatory mandate fields
| Field | What must be recorded | Control purpose |
|---|---|---|
| Decision supported | The approval, intervention, investment or acceptance decision that the client must make. | Keeps the review relevant to accountability. |
| Accountable recipient | The SRO, programme board, owner or SME director receiving the opinion. | Prevents reporting into the delivery line being assured. |
| Delivery claims under test | The specific claims about progress, readiness, quality, cost, risk or recoverability. | Turns status language into testable propositions. |
| Scope and exclusions | Included workstreams, suppliers, dates, systems and material exclusions. | Makes limitations visible before evidence is gathered. |
| Evidence access | Required artefacts, source systems, interviews and direct access rights. | Stops evidence selection being controlled by the subject of the review. |
| Assessment criteria | The standards, obligations, acceptance criteria and rating model to be used. | Prevents the test from changing after findings emerge. |
| Review period and cut-off | The period examined and the date after which new evidence is treated separately. | Protects the integrity of the evidence set. |
| Reporting and escalation | Recipients, factual accuracy process and route for urgent concerns. | Ensures material findings reach the client promptly. |
| Independence declaration | Delivery interests, prior roles, conflicts and safeguards. | Protects the credibility of the opinion. |
| Closure expectation | Who owns action, what evidence proves closure and who verifies it. | Prevents recommendations being treated as risk reduction. |
Mandate workflow
1. Frame the decision
2. Authorise access
3. Test the claims
4. Report the opinion
5. Verify conditions
Mandates that should be challenged
| Weak instruction | Why it fails | Required correction |
|---|---|---|
| Take a quick look | No decision, boundary or evidence threshold is defined. | Name the decision and the minimum evidence needed. |
| Confirm that the programme is green | The conclusion has been selected before the review. | State the supplier claim and allow all supported outcomes. |
| Review everything | The scope is unbounded and materiality is unclear. | Prioritise the decisions, risks and delivery obligations that matter. |
| Work through the supplier PM | Evidence access and interview selection may be constrained. | Give the reviewer direct, client-authorised access. |
| Do not disrupt delivery | A reasonable concern can become a restriction on scrutiny. | Agree proportionate access, timing and escalation in advance. |
What the mandate does not do
The mandate does not transfer delivery ownership to Enigma. The supplier remains responsible for delivery and for producing the evidence needed to support its claims. The client retains accountability for decisions, risk acceptance and intervention.
It also does not guarantee that sufficient evidence exists. If access is restricted, records are incomplete or controls have not operated for long enough, the correct output may be an insufficient evidence conclusion rather than a forced positive or negative opinion.
Application by client context
| Context | Typical mandate focus |
|---|---|
| Central Government | Major approval decisions, multi-supplier dependencies, public accountability, delivery confidence and readiness evidence. |
| Local Government | Citizen service continuity, affordability, supplier control, statutory operations and safe transition with limited internal assurance capacity. |
| SME | Protection of investment, supplier claims, go-live exposure, operational resilience and a proportionate alternative to a permanent assurance team. |
Minimum commissioning test
- Can the client name the decision that the review will support?
- Can the supplier claims be expressed as testable propositions?
- Can the reviewer obtain evidence without supplier filtering?
- Are scope limits and material exclusions explicit?
- Is the route for urgent escalation independent of the delivery line?
- Is the required closure evidence defined before recommendations are accepted?
How this standard supports client governance
This standard gives the client a repeatable basis for challenging delivery claims without taking ownership away from the supplier. It enables proportionate scrutiny, records the reasoning behind material decisions and makes residual uncertainty visible to the accountable decision maker.
Use with
Independence safeguard
No practitioner may independently assure delivery that they directly own. Where advisory support and assurance are both required, roles, reporting lines and review responsibility must be separated and recorded.