Policy stands in for performance
A documented control is treated as reliable although its steps, systems, and exceptions have not been examined.
Open Assurance · Verify
Know whether critical controls actually work
Independently examine selected controls and evidence so leaders can see reliability, gaps, and the decisions required before others rely on the claim.
The business pressureName what must change.
Evidence cannot answer the question
Records are incomplete, inconsistent, or detached from the period and activity leadership wants to understand.
Known concerns lack independence
Teams recognize failures or workarounds but cannot separate anecdote, root condition, and priority.
01 · What we deliver
What we examine and report.
We begin with the decision the intended user needs to make. The work then shows what the evidence supports, where gaps remain, and what requires action.
Assessment terms
Agreed objectives, scope, period, criteria, evidence sources, access, exclusions, and report users.
Control walkthrough record
An independent account of design and performance across people, systems, handoffs, and exceptions.
Evidence sample
Selected records examined for occurrence, timing, review, consistency, exception handling, and stated objective.
Assessment findings
Factual observations describing condition, evidence, significance, contributing factors, and affected objective.
Evidence you can use
Evidence your team can use after delivery.
Each output identifies its source, owner, review point, and next action so the work stays traceable after handoff.
What you receive
- Assessment terms
- Control walkthrough record
- Evidence sample
- Assessment findings
How it stays useful
- Source
- Current source material
- Owner
- Named owner
- Timing
- Relevant period
- Status
- Review status and decision
02 · The Open method
From a precise question to a usable conclusion.
The question, evidence, testing, and conclusion remain easy to follow. Leaders can see what was examined, what was found, and how the result should be used.
Define
Agree the decision, audience, subject, expectations, timing, dependencies, and type of review before testing begins.
Examine
Review the relevant records, configurations, conversations, and technical evidence. We test whether it is current, reliable, and sufficient for the question.
Challenge
Follow exceptions, conflicting evidence, and gaps. The conclusion follows what the work shows, not the preferred story.
Communicate
Explain findings, implications, uncertainty, and the next decision in language the audience can use.
03 · Clear roles
Keep authority clear at every handoff.
Open leads the agreed work. Your team keeps management decisions. Independent reviewers and qualified specialists retain the authority only they can hold.
One clear assurance question
Before we begin, we confirm the question, evidence, review approach, audience, and reporting format. Any change remains visible.
Management keeps ownership
Your team remains responsible for systems, controls, records, remediation, and the information it provides. We examine; we do not take over management decisions.
Use the right qualified provider
If law or a professional standard requires a licensed or accredited report, we make the qualified delivery path clear from the start.
Business results
What changes after the work.
The result should change what the team can do next: reduce exposure, operate a stronger control, answer scrutiny, or make a decision with better evidence.
Reliability is evidenced
Leaders can distinguish documented intent from the design and operation observed.
Remediation starts from facts
Control owners receive specific conditions and evidence to inform their response.
Uncertainty stays visible
Evidence gaps and scope limits remain explicit.
Common questions
What to settle before work starts.
Direct answers on fit, timing, responsibilities, deliverables, and the next commercial step.
How are controls selected?
Selection starts with the business decision, system, data, obligation, or concern that prompted the work.
What evidence can be examined?
Evidence may include records, configurations, approvals, tickets, access reviews, reconciliations, reports, or selected transactions.
How are factual disputes handled?
Draft observations are discussed with process owners. Management responses can be included while Open Assurance retains its independent view.
Can management use the report for remediation?
Yes. Findings inform the response, while management owns priority, funding, implementation, and risk treatment.
Open Assurance
Examine the controls others rely on
Define the control set, intended users, criteria, and decision the assessment must support.