Baseline Comparison
Each baseline finding set against the new evidence, with dates for both.
S/02Commissioned Service
Assurance Change
Review
Do earlier findings still hold now that things have changed?
Evidence-based findings reflect what the available evidence established at the time of examination. When suppliers, systems, controls or operating arrangements change materially, those findings may no longer apply.
The Assurance Change Review revisits a dated baseline of earlier findings, compares it with new evidence, and identifies which findings still hold, which have changed, and which now require verification.
02Client Problem
The problem this addresses
Organisations often continue to rely on assurance obtained before a significant change: a new supplier, a migration, a restructure, or a change in how a service operates.
The earlier findings remain on file and continue to be cited, even though the conditions they described may have moved.
This service re-examines those findings at a point in time, against the change that has occurred.
03Who Commissions
Who typically commissions it
Described by role. These are not client references.
- Boards and committees relying on earlier assurance
- Executives after a supplier change, migration or restructure
- Risk owners whose services have changed materially
- Organisations that previously commissioned a Cyber Analysis report
04Scope
Precise scope
The exact questions and evidence set are agreed in writing before work begins. Within that scope, the work may include the following.
- Confirming the dated baseline: which earlier findings, and as of when
- Identifying the material changes since the baseline
- Comparing baseline evidence with newly supplied evidence
- Classifying each finding as holds, changed or requires verification
- Identifying new questions introduced by the change
05Client Inputs
What the organisation supplies
Findings can only be as complete as the evidence supplied.
- The earlier report or findings forming the baseline, with dates
- A description of the material changes since the baseline
- New evidence relating to each finding in scope
- Change records, supplier documents or revised procedures
- Access to agreed individuals for structured discussion
06Outputs
What you receive
A written report. Its contents are confirmed in the agreed scope, and their depth depends on the evidence supplied.
Finding Status
Each finding classified as holds, changed or requires verification, with reasoning.
Change Analysis
How the material changes affect the findings and the evidence behind them.
Updated Evidence Register
Baseline and new evidence recorded together, with sources, dates and limits.
Questions and Verification Needs
Questions raised by the change, and the evidence needed to resolve them.
Optional, only where agreed in scope
- — An executive evidence briefing on what has changed since the baseline
- — Updated dependency mapping where the change affects a critical service
07Limitations
What this service does not provide
Not automated monitoring or ongoing surveillance
Not continuous assurance between reviews
Not penetration testing, scanning or technical testing
Not a certification or compliance attestation
Not a guarantee that findings will hold after the review
Not a vendor or product recommendation
08Independence
Independence and recommendations
Independence allows Cyber Analysis to state plainly where evidence supports a claim and where it does not.
Reports may recommend that specific evidence be obtained, that a claim be verified, or that particular questions be put to management or suppliers.
Cyber Analysis does not prescribe vendors or products, implement remediation, make management decisions, or certify compliance or control effectiveness.
Decisions on what to do with the findings remain with the organisation.
09Process
How the work proceeds
- 01
Initial enquiry
Describe the baseline and the change that has occurred.
- 02
Scoping
Findings in scope, changes and new evidence are discussed.
- 03
Scope agreed
Baseline, scope and deliverables are agreed in writing.
- 04
Comparison
Baseline and new evidence are examined together.
- 05
Written report
Delivered in the agreed form, dated as of the review.
10Contact
Discuss a scoped engagement
Email a short description of the organisation, the claims or changes of concern, and the decision the work is intended to support. Scope is agreed in writing before any work begins.