All services Every engagement has a fixed, published price. Book a strategy call
Boards run on assurances, and most of what reaches them is assertion. What technology assurance is, how it differs from consulting and internal audit, when it gets called, and what independent reviews cost in the UK.
Boards run on assurances. Programme boards hear that delivery is green, audit committees hear that controls are working, customers are told the platform is secure, and investment committees are told the technology scales. Most of what reaches them is assertion: sincere, usually, but produced by the same people whose work is being described. Technology assurance is the discipline that replaces assertion with verified evidence.
Buyers usually meet the term at one of three moments: a board asks how do we know, a customer or insurer demands independent proof, or a deal needs checking before signature. This guide explains what technology assurance is, what it is not, and what it costs, from a firm that does it for a living under one structural rule.
The short answer. Technology assurance is the independent, evidence based verification of technology claims: that systems, controls, programmes or suppliers really are what they are said to be. It has three defining properties: it is carried out by a party with no stake in the answer, it tests claims against evidence rather than interviews alone, and it produces a written verdict that a board, customer, investor, auditor or insurer can rely on. Consulting builds. Internal audit checks from inside. Assurance verifies from outside.
Strip the industry language away and technology assurance answers one question: can this claim be relied upon? The claim might be that a transformation programme is on track, that security controls operate, that an AI system does what the vendor says, that a target company’s technology supports the price being paid, or that a supplier deserves the trust your contract gives them.
The duty behind it is tightening. The UK Corporate Governance Code now asks boards to monitor the effectiveness of material internal controls and report on them, and technology controls sit inside that duty.
Three properties separate assurance from every other answer to that question. Independence: the reviewer has no stake in the verdict, no work being marked, no follow-on sale depending on a comfortable answer. Evidence: claims are tested at source, in configurations, registers, logs, contracts and code rather than in workshops about them. A verdict: the output is a written opinion with findings and severities that someone else can rely on and act upon. Assurance delivers a verdict rather than advice. The moment it becomes advice, it has changed profession.
| Consulting | Internal audit | Independent assurance | |
|---|---|---|---|
| Who does it | Advisers hired to design and build. | Your own second or third line, inside the organisation. | An external party with no stake in the answer. |
| Question answered | What should we do, and how? | Are we following our own rules? | Would this claim survive outside scrutiny? |
| Who relies on it | Management. | The audit committee, mainly internally. | Boards, customers, investors, insurers, regulators. |
| Typical failure mode | Marking its own homework when asked to assess. | Limited reach into specialist technology domains. | None inherent, if independence is structural. |
Certification sits alongside these rather than replacing them: a certificate is assurance against one published standard at one point in time. Valuable, and checkable at source, but a certificate that a management system exists is not a verdict on whether your transformation programme will land.
The board wants evidence instead of opinions. Before committing serious money, someone asks what the technology position is, and the answers in the room are all produced by interested parties. A customer, auditor or insurer demands independent proof. Contract renewals, insurance applications and enterprise procurement increasingly specify verification that is not self assessment. A programme is too important to rely on its own reporting. Every status report is green, spend is climbing, and nobody in the reporting chain has an incentive to say otherwise. A deal needs checking before signature. Technology claims carry a large share of most deal values, and due diligence is assurance at deal speed. A supplier’s claims carry your risk. Their certificates and their AI need verifying rather than collecting. A certificate has to mean something. Ahead of an external audit, an independent check that the controls operate beats an uncomfortable surprise in Stage 2.
A real review is narrower and deeper than most buyers expect. It starts by defining the question precisely, because assure our technology is not a question and a review that examines everything verifies nothing. It gathers evidence at source: configurations inspected, registers pulled, certificates checked against the issuing bodies, contracts read, logs sampled. It tests claims against that evidence, which is where assertions meet reality. It weighs findings honestly, severity and consequence, instead of a heat map with everything amber. And it writes for the audience that relies on it: a board pack a director can read without a translator, findings that name what must change and what it costs if nothing does.
Good reviews are quick because they are focused: one to four weeks for most questions. And one honest warning: cheap assurance that validates rather than verifies is worse than none, because it converts doubt into false confidence, and false confidence is what expensive failures are made of.
Assurance is only worth what its independence is worth. Our standing rule is structural: if we built it, we do not assure it. A firm reviewing its own build has an interest in the answer, and interests do not yield to professionalism. They yield only to separation. The same logic applies to any provider you use, and the test is one question: what happens when the same firm has done both sides of the work? If the answer is a promise rather than a structure, the assurance is marketing. The full argument is in our guide to governance versus assurance, and it applies to every technology domain, AI included.
At Intelance every assurance engagement has a published price. An Independent Technology Audit examines your technology against evidence, with a written verdict for the board, investor or insurer, from £4,500 + VAT, with most audits between £8,500 and £18,000. The Technology Board Pack gives directors the full evidence based picture in three to four weeks, from £18,000. An AI Assurance Review, our most requested review, verifies AI claims and controls in two to three weeks, from £15,000 + VAT. A Supplier Assurance Review checks one supplier properly at £4,500 + VAT in five to ten working days. M&A technology due diligence runs from £15,000 at deal speed, and delivery assurance watches the programmes that are too important to rely on their own reporting.
It is an independent check that technology claims are true, tested against evidence rather than taken on trust, producing a written verdict that boards, customers, investors and insurers can rely on. The person giving the verdict must have no stake in what it says.
An internal IT audit checks from inside the organisation, usually against its own frameworks, and reports to the audit committee. Independent technology assurance is performed by an outside party with no stake in the answer and is written for people outside the reporting chain: boards, customers, investors and insurers. Many organisations use both. Only one of them survives the question of independence.
At Intelance the prices are published: independent technology audits from £4,500 + VAT with most between £8,500 and £18,000, a board level technology pack from £18,000, AI assurance reviews from £15,000 + VAT, supplier reviews at £4,500 + VAT per supplier, and M&A due diligence from £15,000.
Anyone relying on a technology claim they did not verify themselves: boards approving investment, audit committees signing off risk, customers and insurers extending trust, investors pricing a deal, and executives whose programmes report their own status. If the claim matters and the claimant produced it, assurance is how it becomes reliable.
Most reviews take one to four weeks. A focused audit can conclude in days, a board pack takes three to four weeks, and deal due diligence runs in five to ten working days. Speed comes from precision: a well defined question, evidence at source, and a verdict written for its audience.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a senior adviser. A clear recommendation and a fixed fee in writing, within one UK business day.
Talk to a senior adviser
Technology Assurance
