Independent assurance is most valuable before a decision becomes irreversible. Waiting for visible failure turns assurance into diagnosis and removes options that earlier evidence could have protected.
Key judgement
The trigger is not programme size alone. It is the combination of consequence, reliance on supplier claims, uncertainty and the client’s capacity to challenge the evidence.
The operational problem
Organisations often commission a review only after a milestone slips, go-live is threatened or confidence between client and supplier has broken down. By then, contingency may be consumed, commercial positions entrenched and recovery choices narrowed.
A green status is not a reason to avoid assurance. If the client cannot show the evidence behind it, or lacks the capability to test that evidence, the apparent confidence is itself an assurance gap.
Six practical triggers
| Trigger | Indication | Decision exposed |
|---|---|---|
| Major approval or investment | The next commitment increases cost, dependency or operational exposure. | Approve, condition, defer or redirect. |
| Supplier-led evidence | The delivery party defines most information used to judge progress. | Rely on the claim, require evidence or intervene. |
| Compressed or revised plan | Contingency is reduced and dependencies may be obscured. | Accept the replan or require a credible recovery basis. |
| Quality displaced into later phases | Unfinished system, migration or integration work is pushed into UAT or cutover. | Permit phase entry, reduce scope or hold the gate. |
| Critical service consequence | Failure could affect citizens, payroll, finance or operational continuity. | Accept readiness and residual risk. |
| Limited client capability | No permanent test, architecture, programme recovery or assurance function exists. | Commission proportionate independent challenge. |
Assurance trigger scorecard
| Factor | Lower need | Higher need |
|---|---|---|
| Consequence | Reversible and contained | Critical service or irreversible commitment |
| Evidence | Current, traceable and consistent | Missing, contradictory or supplier-filtered |
| Uncertainty | Stable scope and bounded dependencies | Changing plan, solution or dependencies |
| Client capacity | Experienced independent function | Material skills or capacity gap |
| Time | Options and remediation time remain | Decision window or contingency closing |
| History | Controls operate and findings stay closed | Repeated slippage or reopened actions |
Trigger rule
Commission assurance where two or more higher-need factors could affect the same material decision. A single critical-service or independence concern can be sufficient.
Useful review points
1. Mobilisation
2. Baseline approval
3. Phase or supplier gate
4. Migration and cutover
5. Closure and benefits
Warnings that should not be normalised
- Status remains green while dates move or scope reduces.
- Pass rates improve without clear process coverage or defect exposure.
- A recovery plan provides dates without capacity, dependencies or critical path.
- The same risk returns under new wording after closure.
- Client acceptance is sought before supplier evidence is complete.
- Operational teams are expected to absorb unresolved delivery risk.
- A coherent evidence set cannot be produced without new presentations.
Continuous assurance is not always necessary. A small number of reviews at the right decisions can be more effective, provided scope is precise and closure is verified. The engagement should broaden only if evidence reveals a connected control failure.
Application by client context
| Context | Assurance focus |
|---|---|
| Central Government | Evidence for SRO and programme board decisions, multi-supplier dependency, major approvals and public accountability. |
| Local Government | Citizen service continuity, supplier challenge and proportionate scrutiny without creating a permanent council function. |
| SME | Protection of investment and operations where the technology supplier holds most technical knowledge and evidence. |
The consequence for client governance
The supplier remains responsible for delivery and for producing the evidence behind its claims. The client retains accountability for approval, acceptance and residual risk. Independent assurance gives that client a defensible basis for deciding what to rely on, what to condition and when to intervene.
Related Enigma framework pages
Independence boundary
No practitioner independently assures delivery that they directly own. Delivery support, management action and independent verification must be separated and disclosed.