Transformation assurance is an independent assessment of whether a programme can deliver its intended business outcomes. It examines the evidence behind the plan, the risks being carried and the decisions leadership needs to make.
For a board or executive sponsor, the question is straightforward: do we have enough reliable evidence to commit further money, move to the next stage or accept the consequences of going live?
A programme can produce detailed reporting and still leave that question unanswered.
Why reporting is not enough
Programme reporting describes progress against the delivery team's plan. Independent assurance tests whether the plan remains credible.
A milestone marked green may depend on an untested integration, a supplier commitment that has never been confirmed or an operational team with no capacity to take ownership. The status is accurate only within the assumptions behind it.
I want to see those assumptions exposed. Who has tested them? What happens if they fail? Has the sponsor understood and accepted the resulting risk?
Confidence should survive those questions.
When independent assurance is warranted
Assurance is useful before a major investment decision, a significant delivery commitment or a transition into live operation. It is also warranted when a programme has lost credibility and leadership needs an independent basis for deciding what to do next.
Warning signs include repeated changes to the delivery baseline, benefits that remain vaguely defined, unresolved dependencies and risks that move between reports without an accountable owner.
Another warning is disagreement about what completion means. The supplier may consider the system delivered while the business still cannot operate it safely.
Waiting until the programme visibly fails reduces the choices available. Earlier challenge gives the sponsor more room to act.
What a transformation assurance review examines
The scope should follow the decision being made and the consequence of getting it wrong. For a technology transformation, I would normally examine:
- Business outcomes: what must change, how benefits will be measured and who owns their delivery.
- Governance: sponsorship, decision rights, escalation and the authority to resolve competing priorities.
- Delivery: dependencies, resources, milestones and the evidence supporting forecasts.
- Technology and cyber risk: architecture, integration, security controls, resilience and readiness to operate.
- Commercial exposure: supplier obligations, acceptance criteria, contractual dependencies and exit options.
The documents are a starting point. Interviews, decision records, test results and operational evidence help establish whether the written account matches what is happening.
A review also needs access to people who can challenge the prevailing account. If everyone is expected to repeat the programme narrative, independence exists only on paper.
What the board should receive
The findings should make the next decision easier. They should explain what has been evidenced, where uncertainty remains and which issues could materially change the outcome.
Recommendations need priorities, accountable owners and a clear connection to business consequences. A long list of observations without that connection leaves the sponsor to perform the analysis the review was commissioned to provide.
Where evidence is incomplete, the limitation should be explicit. An assurance report cannot responsibly turn missing information into confidence.
Independent reviews at key decision points are also reflected in the UK Government's project assurance review toolkit. Those materials concern government delivery; they provide useful context rather than a mandatory framework for every commercial programme.
Assurance, audit and programme management
Programme management owns day-to-day delivery. It coordinates the work, manages dependencies and reports progress.
Audit has its own mandate and criteria, often examining controls, compliance and the reliability of evidence. Internal audit can also examine programme governance and delivery risk.
Transformation assurance focuses on the sponsor's confidence in a consequential delivery decision. Its scope can overlap with audit, but it does not automatically replace audit or take over programme management.
The boundaries should be agreed before the review starts, including who commissions it, who receives the findings and how conflicts of interest are managed.
What happens after the review?
The sponsor decides whether to proceed, change the scope, pause delivery or commission further investigation. Actions should enter the programme's governance, with owners, deadlines and evidence of completion.
Where material concerns remain, a follow-up review can test whether the corrective action has addressed them. Closing an action in a tracker is not enough.
I bring the experience of concurrent CIO and CISO accountability to these questions. Technology choices, control obligations and operational consequences need to be considered together.
Gratmore's Transformation Assurance assessment sets out the scope of a defined review. If a programme needs independent challenge before its next decision, schedule a call with me.
