Independent delivery assurance is a client-side examination of whether material delivery claims are supported by sufficient evidence. It is not extra project management, supplier quality control or a retrospective audit.
Key judgement
Its purpose is to give the accountable client a defensible basis for a decision. Where a claim cannot be traced to reliable evidence, the review must state the limitation rather than convert assertion into confidence.
The operational problem
Outsourcing technology delivery does not outsource accountability. A supplier can own the plan, solution, testing and cutover activity, but the client still decides whether to invest, accept, intervene or go live. That decision remains exposed when the only evidence comes from the party responsible for meeting the date.
Supplier reporting serves a legitimate delivery purpose. Independent assurance asks a different question: is the evidence strong enough for the client to rely on the claim and accept the consequence? This distinction keeps Enigma on the client’s side of the table without treating the delivery supplier as an adversary.
How independent assurance works
1. Define the client decision
2. Identify material claims
3. Obtain source evidence
4. Test controls and contradictions
5. Issue a bounded opinion
The operating boundary
| Party | Owns | Does not own |
|---|---|---|
| Delivery supplier | Plan, solution, quality controls, testing, delivery evidence and remediation. | The independent conclusion or the client’s risk decision. |
| Client | Objectives, investment, acceptance, risk ownership and accountable governance. | The supplier’s delivery obligations. |
| Independent assurer | Evidence tests, findings, confidence, limitations and closure verification within mandate. | Delivery management or the client’s decision authority. |
What the review tests
- Whether status claims can be traced to current source records.
- Whether stated controls operate in practice and produce the intended result.
- Whether milestones reflect entry criteria, dependencies, capacity and remaining work.
- Whether quality reporting represents business and operational risk, not simply test activity.
- Whether contradictions, exclusions and uncertainty are visible to accountable governance.
- Whether completed actions have reduced exposure and can be independently verified.
What it is not
| Activity | Why it is different |
|---|---|
| Supplier QA | Necessary control over the supplier’s own work, but not independent of delivery ownership. |
| PMO reporting | May consolidate status without testing the underlying technical and operational evidence. |
| Internal audit | Often examines organisational control or compliance under a different mandate and timetable. |
| Delivery recovery support | Owns or influences corrective action, which must be separated from independent verification. |
| A guarantee | Improves the decision basis but cannot remove future uncertainty. |
A useful assurance output
The output should identify the decision examined, scope, evidence, confidence, material findings, limitations, conditions and closure requirements. It should allow a board, SRO or SME director to act. A report that restates programme status or provides an unexplained score has not closed the assurance gap.
Application by client context
| Context | Assurance focus |
|---|---|
| Central Government | Evidence for SRO and programme board decisions, multi-supplier dependency, major approvals and public accountability. |
| Local Government | Citizen service continuity, supplier challenge and proportionate scrutiny without creating a permanent council function. |
| SME | Protection of investment and operations where the technology supplier holds most technical knowledge and evidence. |
The consequence for client governance
The supplier remains responsible for delivery and for producing the evidence behind its claims. The client retains accountability for approval, acceptance and residual risk. Independent assurance gives that client a defensible basis for deciding what to rely on, what to condition and when to intervene.
Related Enigma framework pages
Independence boundary
No practitioner independently assures delivery that they directly own. Delivery support, management action and independent verification must be separated and disclosed.