Claim Assessment
Each claim in scope classified as Substantiated / Partially supported / Unverified / Contradicted, with the reasoning stated.
S/01Commissioned Service
Independent Assurance
Challenge
How much of what you are told about security is supported by evidence?
Boards and senior leaders receive regular assurance about security and controls. The Independent Assurance Challenge examines selected assurance claims against the evidence supplied to support them.
Claims are classified as Substantiated / Partially supported / Unverified / Contradicted, with a separate analysis of contradictions between claims and evidence or between sources.
02Client Problem
The problem this addresses
Assurance often arrives as summaries: dashboards, status reports, attestations and verbal updates.
Those summaries may be accurate. But the people relying on them rarely see the underlying evidence, and the gap between what is reported and what can be shown is seldom examined independently.
This service examines that gap, claim by claim.
03Who Commissions
Who typically commissions it
Described by role. These are not client references.
- Board members and non-executive directors
- Audit and risk committee chairs
- Chief executives and finance directors
- Senior leaders inheriting existing assurance arrangements
04Scope
Precise scope
The exact questions and evidence set are agreed in writing before work begins. Within that scope, the work may include the following.
- Selection of the assurance claims to be examined
- Tracing each claim to the evidence offered in support
- Classifying claims as Substantiated / Partially supported / Unverified / Contradicted
- Identifying contradictions between claims and evidence, or between sources
- Noting where evidence is dated, indirect or self-reported
- Framing questions for management where evidence is incomplete
05Client Inputs
What the organisation supplies
Findings can only be as complete as the evidence supplied.
- The assurance reports, papers or statements in scope
- The evidence management relies on for each claim
- Policies, standards and procedures referenced by the claims
- Relevant supplier assurance documents already held
- Access to agreed individuals for structured discussion
06Outputs
What you receive
A written report. Its contents are confirmed in the agreed scope, and their depth depends on the evidence supplied.
Contradictions
Points where the evidence conflicts with the claim, or where sources conflict with each other.
Evidence Register
The evidence examined, its source, date and limits, referenced to each claim.
Questions for Management
Specific, evidence-based questions where claims could not be substantiated.
Verification Recommendations
Where appropriate, the further evidence that would allow a claim to be confirmed.
Optional, only where agreed in scope
- — An executive evidence briefing summarising the findings for a board or committee
- — A dependency mapping section where claims concern critical services
07Limitations
What this service does not provide
Not a certification of control effectiveness
Not penetration testing, vulnerability scanning or technical testing
Not a compliance audit or attestation
Not a judgement on the competence of individuals
Not a guarantee that substantiated claims will remain true
Not a vendor or product recommendation
08Independence
Independence and recommendations
Independence allows Cyber Analysis to state plainly where evidence supports a claim and where it does not.
Reports may recommend that specific evidence be obtained, that a claim be verified, or that particular questions be put to management or suppliers.
Cyber Analysis does not prescribe vendors or products, implement remediation, make management decisions, or certify compliance or control effectiveness.
Decisions on what to do with the findings remain with the organisation.
09Process
How the work proceeds
- 01
Initial enquiry
Describe the assurance of concern and the decision it supports.
- 02
Scoping
Claims, evidence sources and boundaries are discussed.
- 03
Scope agreed
Claims in scope and deliverables are agreed in writing.
- 04
Evidence examination
Each claim is traced to the evidence supplied.
- 05
Written report
Delivered in the agreed form.
10Contact
Discuss a scoped engagement
Email a short description of the organisation, the claims or changes of concern, and the decision the work is intended to support. Scope is agreed in writing before any work begins.