Control effectiveness testing
Sample-based testing of governance, oversight and technical controls as operated, not as documented.
All services
Governance & Trust
Independent AI Assurance
An independent opinion your risk committee can rely on.
- Independent
- No build stake in the outcome
- 4–6 wks
- Typical review cycle
- Board-ready
- Findings and management response
The problem we solve
Boards increasingly need assurance that is not written by the team that built the system. We review models, vendors and controls against a published methodology and report findings plainly, including the ones nobody wanted.
What the work includes
Model review
Performance, bias, robustness and documentation quality assessed against intended use.
Vendor assurance
Third-party AI supplier review covering security, data use, model change management and exit.
Regulatory readiness
Gap assessment against EU AI Act, ISO 42001, sector rules and internal policy.
How the engagement runs
A sequence you can plan a quarter around.
- 01
Scope
Systems in scope, methodology and reporting lines agreed in writing.
- 02
Test
Evidence collection, control testing, interviews and model review.
- 03
Report
Draft findings, management response and committee readout.
Common questions
Before you commit.
- Can you assure systems you built?
- No. Where we delivered the build, we bring in an independent reviewer or step aside from the assurance role.
- Does this satisfy an external audit?
- It prepares you for one and often reduces its length, but it does not replace a statutory or certification audit.
Related practices
AI Governance & Compliance
Model registry, risk classification, documentation and audit trails mapped to the EU AI Act, ISO 42001 and internal policy.
ViewAI Security & Red Teaming
Prompt-injection defence, data exfiltration testing, agent abuse scenarios and adversarial evaluation before attackers get there.
ViewPrivacy & Data Residency
PII handling, retention, minimisation and EU/North American residency designed in rather than retrofitted.
ViewTalk through independent ai assurance.
A 45-minute briefing with the people who would run the work — scope, timeline and a straight answer on whether it is the right next step.