Cyber risk assessment
A structured view of your most significant cyber risks and how well they are managed.
Services · Assurance, Reviews & Due Diligence
Independent Assurance & Challenge Reviews
An independent view on whether your assurances stand up.
Arrange a meetingWhy it matters
Bank boards are told that controls are in place, plans are tested and suppliers are secure. An independent review tests those statements against evidence. We provide objective, proportionate challenge so leaders know where they can rely on assurance and where they cannot.
Questions this engagement answers
- 01Is the evidence behind our key assurances current and complete?
- 02Did our recovery test cover the whole service, or only part of it?
- 03Are there risks management has accepted that the board does not know about?
- 04What would an informed outsider conclude about our position?
What the engagement can include
Challenge review
Independent testing of specific assurances, programmes or board statements.
Post-incident review
Objective review of what happened, how the response performed and what needs to change.
Programme assurance
Independent checks on major security or resilience programmes.
How we work
- 1
Agree scope
Define the assurances or risks to be tested and who the report is for.
- 2
Gather evidence
Review documents, test results and records, and interview key people.
- 3
Conclude
Reach proportionate conclusions, separating what is proven from what is assumed.
- 4
Report
Present findings clearly to the board, with practical recommendations.
What you receive
- Independent findings report written for directors
- Clear conclusions on where assurance can and cannot be relied on
- Prioritised, proportionate recommendations
- Presentation to the board or committee
Illustrative scenario
A successful recovery test with a missing piece
Management reports that disaster recovery was tested successfully. Reviewing the test records shows the external payment connection was excluded because it was too difficult to include. The service could be restored internally, but not used by customers. The board's assurance was accurate in detail but misleading in effect, and the review gives it the evidence to ask for a complete test.
Buck's view
“Independence matters most when the news is uncomfortable. A good review tells the board what it needs to know, in proportion, with the evidence to back it up.”
Professor Buck Rogers, Poro Advisory