Skip to main content
    ProductsReign Assurance

    A record that holds, and a decision that stays with the people who own the risk.

    Reign Assurance is being built with the control functions that will have to rely on it: which checks, which exceptions, in whose format. The concept is Continuous Agentic Assurance. This page describes what it is being designed to do, and what it is not.

    Every claim on this page is written in the design tense on purpose. Where a thing is not built, we say so.

    The spine design target
    Agreed before anything runs What comes out of it Scope Requirement Check Evidence Authority what is covered · the obligation it serves · what runs and what it misses · what it produced and how far it reached · who may rely on it The check cannot decide ambiguous condition · unclear scope · it was never a machine decision It goes to a named person written next to the check A check chosen after the result is known is not a check Material for a human review. Not a verdict, not an audit opinion.
    Five nodes, each one constraining the next. It is the reason the page will not promise more than it does.
    Read this before anything else. iTmethods does not issue an audit opinion or a certification, and nothing here is independent assurance of anyone's controls. Reign prepares the evidence; the people who own the risk decide.
    How a claim gets built

    Scope, requirement, check, evidence, and only then a claim.

    Assurance for automated work is usually treated as a reporting problem. It is not one. What a reviewer, a regulator or a board needs is five things answered in a fixed order — and answered out of order, the last one will be wrong, because a check cannot be judged without the requirement it serves, and a requirement cannot be judged without the scope it sits in.

    Agreed before anything runs
    What comes out, and who may rely on it
    Scope
    What is covered and what is not, written down before the first check runs.
    Requirement
    The obligation the check exists to serve. Named, not implied.
    Check
    What runs, what it examines, and what it therefore cannot see.
    Evidence and coverage
    What the check produced, and how far it reached. The gap is recorded beside it.
    Results and authority
    What may be concluded, and who is entitled to rely on it. Not a verdict.
    The check cannot decide The condition is ambiguous · the scope is unclear · it was never a machine decision
    It goes to a named person with the context attached, and their decision is written next to the check that raised it.
    What a pass can establish

    The check decides the ceiling on the claim.

    A check has a type and it has an assertion, and they are not the same thing. The type is how it finds out. The assertion is what a pass is capable of establishing. Holding them apart is what stops a result travelling further than the evidence behind it.

    01The type is the technique
    Validation, test, evaluation, policy check, evidence check, replay, reperformance, reconciliation, human review. The type tells a reviewer how the check went about it, which is the question most often skipped.
    02The assertion is the ceiling
    Completeness, accuracy, authorization, timeliness, traceability, segregation of duties, and the rest. A check that establishes authorization has said nothing about completeness, and the record does not let it pretend otherwise.
    03Why they are held apart
    A technique that reports a score invites the reader to decide what the score meant. A technique tied to a named assertion does not. It also lets different techniques roll up on common terms rather than on one tool’s numbers.
    04The AI-specific ones are carried, not buried
    Explainability, human oversight and outcome achievement are assertions in their own right rather than components of a general risk rating. Where a check cannot establish one of them, that is visible rather than averaged away.
    Checks and exceptions

    What passed. What did not. What needs a person.

    This is the third node of the spine, opened up. Checks run against work as it moves rather than being assembled after the fact, and a check ends in one of three states. Most assurance tooling is built to drive the third towards nothing. This is being designed for the opposite, and that is the single design decision everything else follows from.

    01Passed
    A check ran, the conditions were met, and the record shows when it ran and against what.

    The useful part is not the pass. It is that the record says which check, against which version, at what time.

    02Did not pass
    The record is intended to show the failing condition in plain terms, not a score.

    A number tells a reviewer that something is wrong. A named condition tells them what to do about it. This is the state that reaches the record as not supported.

    03Needs a person
    A system that quietly resolves ambiguity in its own favor is worse than one that stops and names the ambiguity.

    The check could not decide, or the decision was never a machine decision to begin with. The exception is routed to a person with the context attached, and their decision is written down next to the check that raised it. Until they decide it stands as inconclusive and not as a pass.

    The edge of it

    A tool that reports on what it cannot see is not producing evidence.

    What the record reaches, and what it does not In scope Systems in the agreed scope Checks that ran, and when The conditions they tested a reviewer walks this without us and every view carries the scope it was drawn from Outside it Work done elsewhere Systems not in the deployment Not assessed — no check ran Listed, not omitted the gap is recorded beside the evidence, not in a release note A tool that reports on what it cannot see is not producing evidence It is producing comfort
    Coverage reaches as far as the systems in scope and no further. The half a reviewer needs most is the half most products leave off the picture.
    Evidence and coverage

    What a reviewer can follow, without asking us.

    Evidence is only useful if a reviewer can walk it without our help, and only honest if the edge of it is stated.

    Design target

    What a reviewer should be able to walk

    Five things, in sequence, without an engineer reconstructing them

    The change, from the request that started it to the state it left the system in.

    Which checks ran against that change, and when.

    Which checks did not run, and the reason they did not.

    Every exception raised, who it went to, what they decided, and when they decided it.

    Who held the access required to make the change at the time it was made.

    Stated, not hidden

    Where the walk stops

    Coverage is bounded, and the bound is part of the record

    Coverage reaches as far as the systems in scope for a given deployment. Work outside those systems is outside the record, and the record says so rather than implying completeness.

    This is the row most likely to be tested in a review, and it is the one most assurance tooling leaves for the reader to discover.

    What you can check without us

    The package leaves with a verifier that runs on its own

    Verification does not depend on our good behavior

    An evidence package can be checked outside Reign. The verifier runs on its own, against the package, without access to our systems and without our database — which is the point of it. Origin is established against a key you obtain from us separately, so the strength of the check rests on your key handling rather than on our good behavior.

    Where this stands

    What exists today, and what does not.

    Reign Assurance is not sold and is not shipping. That is the commercial position, and it is not the whole picture, so here is the rest of it.

    01What exists
    The assurance model itself: the objects, how they relate, and the separation of check type from assertion described above. A demonstration that runs the model over synthetic workflows and synthetic data, exercising checks, results, exceptions and the lineage between them. Deterministic and model-assisted checking patterns, each with its limits and its result states written down. An evidence package with the verifier described above.
    02What does not
    Any of it running against a customer’s real work. Bindings into the systems you treat as authoritative. Longitudinal coverage reporting across populations and periods. The calibration and change-control machinery that would have to sit around the checks before any of this is a product.

    Nothing here has been run against a live estate, and no customer relies on it today.

    Co-design

    What co-design actually means here.

    The word is used loosely in this industry. This is what it means when we use it, and what it would look like on your side.

    1

    One named population

    Each engagement covers one named population of work. Scope is written down at the start. If it grows, that is a new conversation and not an assumption.

    2

    A named engineer, embedded

    They sit with the team, see the real conditions rather than the described ones, and take the findings back into the design.

    3

    Your conditions change the design

    This is the part that makes it co-design rather than a pilot. What you push back on is what gets rebuilt.

    4

    It ends where you agreed it ends

    How long an engagement runs, and what closes it, is written down alongside the scope before anything starts. Nothing here is open-ended and nothing renews by default.

    What it costs you. Scope is agreed first, and the effort and the commercial relationship follow from it. All of it is written down before anything starts, and we do not publish it, because no two estates make the same ask. What taking part never confers is a place in a queue, a licence or a claim on the design.
    What we ask for. Access to one real population of work, and time with the people who own it. Not a transformation program and not a signature on a multi-year plan. If the ask feels large, we have described it badly. How co-design works →

    We are working with a small number of organizations, not a waiting list. The number is small because the work is close, and close work does not scale by adding logos to a slide.

    Who this is for

    Four people, four different questions.

    Reign Assurance is being designed against the questions these four ask, in the order they ask them. Each has a page already written for them.

    The chief audit executive
    Needs to know whether the controls described on paper are the controls operating in practice, and how much of the evidence was assembled only after it was asked for.
    Written for you →
    The chief risk officer
    Sits in front of a regulator, a board or a customer and has to account for what the systems did, who decided it, and what was not covered.
    Written for you →
    The CISO
    Owns the question of who held the access required to make a change, at the time it was made, and whether that is reconstructable later.
    Written for you →
    The engineering leader
    Responsible for delivery moving at a sensible pace, and for the controls not becoming a second job. Wants checks that run where the work already happens.
    Written for you →
    The ask

    Bring us regulated work under real pressure.

    If you have work that has to be defended and you are willing to let us look at it closely, that is the conversation worth having. There is no product to buy, and the scope is agreed before anything starts.