Internal audit and independent technology delivery assurance both provide challenge, but they operate at different points, against different questions and for different decisions. Internal audit examines whether governance, risk management and controls are designed and operating appropriately within its mandate. Independent delivery assurance tests whether current delivery evidence is sufficient for a specific client decision.
The functions can complement each other. Treating either as a substitute for the other creates a gap when a programme board needs a time-critical judgement on supplier delivery, testing, migration, cutover, recovery or go-live.
What internal audit is designed to do
Internal audit provides independent examination of governance, risk management and control arrangements within its agreed remit. Its work can identify systemic weaknesses, test whether controls are operating as intended and provide valuable organisational oversight.
That perspective is important. Technology programmes should not sit outside the organisation’s wider control environment. Internal audit can identify whether programme governance, risk ownership, procurement, security, financial control or policy compliance require attention.
What independent delivery assurance is designed to do
Independent Delivery Assurance is narrower and more decision-specific. It asks whether the evidence available now justifies the next material commitment the client is being asked to make.
That can include accepting a supplier milestone, entering UAT, approving a migration, accepting a recovery plan, authorising cutover or deciding whether residual risk is acceptable for go-live.
| Dimension | Internal audit | Independent delivery assurance |
|---|---|---|
| Primary question | Are governance, risk and controls appropriately designed and operating within the audit scope? | Does the current evidence support this specific delivery decision? |
| Typical perspective | Organisational control and assurance. | Programme delivery evidence and decision exposure. |
| Timing | Planned around an audit programme or defined review. | Aligned to material programme decisions and delivery events. |
| Evidence focus | Control design, operation, compliance and governance evidence. | Source delivery evidence, exceptions, dependencies, residual risk and readiness. |
| Typical output | Audit findings, opinions and agreed management actions. | Evidence-based assurance position, limitations and decision conditions. |
Where the distinction matters
A programme can have an effective governance framework and still lack sufficient evidence for a particular go-live decision. Conversely, a programme may have strong technical readiness evidence while exposing wider control weaknesses that properly belong within internal audit’s remit.
The difference is therefore not which function is more rigorous. It is which question needs answering, at what point, using which evidence and with what consequence if the judgement is wrong.
When internal audit is the appropriate model
- The organisation needs independent examination of governance, risk or control effectiveness.
- The question concerns compliance with an established organisational control or policy.
- Leadership needs a broader view of systemic control weakness across functions or programmes.
- The review is intended to inform the organisation’s formal assurance and audit environment.
When delivery assurance is the appropriate model
- A programme board must decide whether a supplier milestone is genuinely achieved.
- Reported status is stronger than the underlying delivery evidence appears to justify.
- Testing, UAT, migration, cutover or operational readiness requires evidence-based challenge.
- A recovery plan needs to be tested against the constraints that caused the delivery problem.
- A go-live decision will transfer material technology and operational risk into the business.
- The decision window is shorter than a broader audit cycle and requires direct access to current programme evidence.
Independence boundaries
Both functions depend on credible independence, but independence must be judged against the work being examined. Enigma’s Independence and Conflict Standard requires separation between delivery ownership and assurance judgement. A practitioner should not independently assure controls or delivery they directly own.
Internal audit should retain its own mandate and reporting independence. Delivery assurance should not attempt to become a parallel internal audit function. Its mandate should remain tied to the defined programme decision and the evidence material to it.
How the functions can work together
Internal audit findings can identify control weaknesses that delivery assurance should consider when judging programme evidence. Delivery assurance findings can expose recurring control failures that may warrant broader internal-audit attention. The outputs can inform each other without merging the mandates.
The Assurance Mandate defines the decision, evidence access and reporting route for an Enigma review. The Evidence Sufficiency Standard sets the threshold for relying on delivery evidence, while the Decision Condition Framework converts unresolved evidence gaps into explicit conditions where appropriate.
Decision test for buyers and programme boards
| If the question is… | Primary model |
|---|---|
| Are organisational controls appropriately designed and operating? | Internal audit. |
| Is a policy or control requirement being followed? | Internal audit or the relevant compliance function. |
| Does the evidence justify accepting this supplier milestone? | Independent delivery assurance. |
| Is the programme ready to migrate, cut over or go live? | Independent delivery assurance integrated with accountable client governance. |
| Does a delivery finding indicate a wider systemic control weakness? | Potentially both, with separate mandates. |
Avoiding duplicate assurance
The efficient model is to reuse reliable evidence rather than commission overlapping reviews. Internal audit should not have to recreate detailed delivery assurance, and delivery assurance should not repeat established organisational control testing unless it is material to the programme decision.
For adjacent distinctions, see Independent Assurance vs PMO, Independent Assurance vs Systems-Integrator Assurance and Independent Assurance, Internal QA and Supplier Governance.