An assurance report should not create a long list of observations and leave the client to decide which ones matter. Findings must be classified by consequence, immediacy, control failure and evidential strength.
Key judgement
Classification exists to direct governance attention. It must distinguish a useful improvement from a condition that could invalidate a major decision.
Why issue lists are not assurance
Conventional reviews often confuse quantity with rigour. Minor documentation gaps sit beside threats to service continuity, while every item receives the same action-plan treatment. This makes reporting harder to govern and gives delivery teams an incentive to close easy actions while material exposure remains.
The model classifies the finding at the level of client consequence. Priority and due date are then set separately, based on when intervention is required.
Finding classes
| Class | Definition | Expected response |
|---|---|---|
| Observation | A supported improvement or minor weakness with no current material effect on the decision. | Record for management action or planned improvement. |
| Concern | A control weakness or emerging risk that could become material if it is not corrected. | Assign an owner, due date and proportionate closure evidence. |
| Material Finding | A substantiated weakness that affects confidence in a significant delivery claim, obligation or decision. | Escalate to accountable governance and attach a decision condition or intervention. |
| Critical Finding | An evidenced condition with immediate or severe consequence, or one that makes the proposed decision indefensible. | Escalate immediately. Stop, defer or redirect the decision unless the client explicitly accepts the exposure. |
Classification dimensions
| Dimension | Assessment question |
|---|---|
| Consequence | What happens to service, cost, schedule, quality, compliance, operations or public accountability if the condition persists? |
| Immediacy | How soon could the consequence occur, and how much time remains to intervene? |
| Control failure | Is the weakness isolated, repeated or systemic? Is the intended control operating? |
| Evidence strength | How directly and consistently does the evidence support the finding? |
| Decision effect | Could the finding change an approval, investment, go-live, acceptance or recovery decision? |
Decision matrix
| Decision effect | Control position | Typical class |
|---|---|---|
| No material effect | Isolated improvement | Observation |
| Potential future effect | Weak or deteriorating control | Concern |
| Current effect on a material claim | Ineffective or absent control | Material Finding |
| Decision is unsafe or indefensible | Severe failure or immediate exposure | Critical Finding |
Anatomy of a defensible finding
- Condition: what is happening now, stated without speculation.
- Criteria: the obligation, control, plan, acceptance criterion or standard not being met.
- Evidence: the traceable records and corroboration supporting the finding.
- Consequence: why the condition matters to the client decision.
- Cause: the evidenced underlying reason, where known.
- Required decision or action: what governance must decide or management must change.
- Owner and date: who is accountable and when the response is required.
- Closure evidence: what will prove that exposure has actually reduced.
Severity is not priority
A Material Finding may need immediate attention, but severity alone does not determine action sequence. A lower-severity control gap with a rapidly closing decision window may require earlier action. Conversely, a Critical Finding should not be downgraded simply because the corrective action will take time.
Factual accuracy without negotiated findings
The delivery team should be given a controlled opportunity to correct factual errors and provide missing evidence. That process must not become negotiation over the conclusion. New evidence can change a finding. Discomfort with the consequence cannot.
Classification rule
Classify the effect on the client’s decision, not the inconvenience of the remedial action. Do not inflate language, and do not soften a material conclusion to preserve a programme status.
How this standard supports client governance
This standard gives the client a repeatable basis for challenging delivery claims without taking ownership away from the supplier. It enables proportionate scrutiny, records the reasoning behind material decisions and makes residual uncertainty visible to the accountable decision maker.
Use with
Independence safeguard
No practitioner may independently assure delivery that they directly own. Where advisory support and assurance are both required, roles, reporting lines and review responsibility must be separated and recorded.