All services Every engagement has a fixed, published price. Book a strategy call
When a board needs independent technology assurance, how to write a mandate that produces a verdict, three tests of real independence, and what to do with the findings.
A board asks whether the new platform will land on time, whether the estate is secure, or whether the AI the business has started using is under control. The answer arrives from the executives responsible for the thing being asked about. That is not dishonesty. It is structural. Nobody reports weakness in their own work as plainly as an outsider would, and directors know it, which is why the same question keeps returning to the agenda.
This guide is about commissioning the answer properly. It covers the triggers that mean a board genuinely needs independent assurance, how to write a mandate that produces a usable verdict, the tests that separate real independence from a claim of it, and what to do when the findings land. It is written for directors, audit committee chairs and company secretaries rather than technologists. Intelance provides independent technology assurance, so read the recommendations with that in mind. The independence tests below apply to us as much as to anyone else.
The short answer. Commission independent technology assurance when the board needs a verdict it cannot get from the people doing the work. Write a mandate with one question, a named recipient, a fixed fee and a right to report unfiltered. Check independence structurally by asking what the provider earns if problems are found. Require evidence tested at source instead of workshop opinion, and put the findings on the audit committee agenda with owners and dates. Reviews commonly run from £4,500 + VAT for a focused piece to £18,000 + VAT and above for a full board level examination.
Independent assurance is worth commissioning when the answer carries consequence and the usual reporting line cannot supply it credibly. Six situations account for most legitimate requests.
Equally, there are moments when the honest answer is that you do not need it. If the board simply has not asked the executive team a direct question yet, ask that first. If the concern is capability rather than truthfulness, hire or train. If the answer would not change any decision, the review is a document rather than a control.
Boards often commission the wrong thing, usually something broader and more expensive than the question required. Use the question to pick the work.
| What the board is asking | The right piece of work | Indicative fee |
|---|---|---|
| Is this programme really going to land, and what will it cost to fix if not | A focused delivery review of one programme | From £4,500 + VAT |
| Can we rely on what we are being told about the technology estate as a whole | A board level independent technology audit across the main domains | From £18,000 + VAT |
| Are our cyber arrangements defensible at board level | A cyber governance review measured against recognised expectations | From £12,500 + VAT |
| Is the AI now in use inside the business governed at all | An AI governance review with a register of what is running | From £15,000 + VAT |
| What are we buying, and what will integration really take | Technology due diligence before completion | From £15,000 + VAT |
| Can we rely on this critical supplier | A single supplier assurance review | From £4,500 + VAT |
Every fee above is a floor and is agreed in writing before work begins. Our guide to what an independent technology audit costs explains what moves the number, and what technology assurance means sets out the discipline behind all of these.
Weak assurance usually traces back to a weak mandate. A page is enough, and these eight points are what make the difference between a verdict and a description.
Independence is a structure rather than a promise, and it can be tested in three questions before you appoint anybody.
What do you earn if you find problems? A provider who follows findings with a remediation proposal has an interest in finding them. A provider who cannot bid for the fix has no such interest. Ask directly, and get the answer in the engagement letter.
Who else here pays you? A firm already delivering the programme cannot review it. Neither can the systems integrator, the incumbent managed service provider, nor the vendor whose product is under examination.
Who sees the report first? If findings route through the executive being reviewed before reaching the committee, independence has already gone. The chain must run to the board.
The same logic governs the wider assurance question, and our guide to governance versus assurance explains why the separation matters in every technology domain.
Boards should judge the output against four things, and reject it politely if any are missing.
| What to expect | A strong report | A weak report |
|---|---|---|
| A verdict | States plainly whether the board can rely on the position, and on what basis | Describes the landscape and leaves the conclusion to the reader |
| Evidence | Claims tested at source in configurations, registers, contracts and logs | Findings drawn from interviews and workshops about those things |
| Weighted findings | Each finding carries severity, consequence and the cost of inaction | A heat map with most items amber and no ranking that helps |
| Readability | A non technical director can read it without a translator | Architecture diagrams and tooling detail in place of an answer |
The findings are the beginning of the governance, and this is where most value is lost. Four steps hold the value.
Directors who want a structured way to frame the questions in the first place will find the NCSC Board Toolkit useful for cyber, and the Three Lines Model helpful for understanding where independent review sits relative to management and internal audit. Where personal data is involved, the ICO sets the accountability expectations a review should test against.
We take no implementation revenue, resell no software and do not bid for the remediation we recommend, which is what allows the verdict to be uncomfortable when it needs to be. Senior people do the work, fees are fixed in writing beforehand, and the report goes to whoever commissioned it.
An Independent Technology Audit runs from £4,500 + VAT for a focused review and from £18,000 + VAT at board level. A Cyber Governance Review for Boards starts from £12,500 + VAT. For transactions, technology due diligence starts from £15,000 + VAT and post deal assurance covers the period after completion. Suppliers are handled through a Supplier Assurance Review from £4,500 + VAT. The full picture sits on our technology, delivery and M&A assurance page, and independent assurance explains the practice as a whole.
It is an examination of technology, delivery or cyber arrangements by a party with no stake in the answer, producing a written verdict a board can rely on. It tests claims against evidence at source rather than gathering opinion, and it stops at the verdict instead of continuing into the fix.
The board or audit committee should commission it and receive it. Where the executive team commissions the review of its own work, the reporting line undermines the independence even when the provider behaves properly.
Internal audit is valuable and sits inside the organisation, which suits recurring control testing. Independent external review suits questions where distance from the organisation is the point, such as a programme the business is heavily invested in defending. Many boards use both.
A focused single domain review commonly concludes within days. A board level examination across the main domains typically takes three to four weeks, including evidence gathering, fact checking with management and reporting.
Focused reviews commonly start from £4,500 + VAT, board level audits from £18,000 + VAT, and cyber governance reviews from £12,500 + VAT. Fees vary with the number of domains, the size of the estate and how much evidence already exists in a usable state.
No. A firm reviewing its own delivery has an interest in the conclusion, and professional intent does not remove a commercial interest. Only separation does. The same applies to the incumbent managed service provider and to any vendor whose product forms part of the scope.
Accept them on the record, assign each one to a named executive with a date, agree a reread after the remediation window, and minute the decisions. Severe findings become a governance problem only when a board receives them and does nothing traceable.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a senior adviser. A clear recommendation and a fixed fee in writing, within one UK business day.
Talk to a senior adviser
