07 · External Assurance Readiness
Use: A third-party assurer (e.g. Social Value International accredited practitioner, B-Corp recertification auditor, a client's internal audit team) should be able to walk in, ask for a number, and have the full chain back to raw data in their hands within one working day.
Owner: Head of Impact. Re-tested: quarterly via a self-drill.
The 12-item readiness checklist
| # | Item | Where it lives | Refresh cadence |
|---|---|---|---|
| 1 | Impact measurement framework (file 01) | This repo, published | Annual |
| 2 | SROI methodology (file 04) with version number | This repo, published | Annual + on any change |
| 3 | Financial proxies table with sources and dates | Evidence Room (file 08) | Annual (Q1) |
| 4 | Confidence factor calculation worked example | Evidence Room | Annual |
| 5 | Anonymised dataset behind last annual report | Public website + Evidence Room | Annual |
| 6 | Per-engagement working spreadsheets (last 12 months) | Evidence Room, access-controlled | Per engagement |
| 7 | Coach files for the active bench (Sprint 7 / 05) | Coach files, access-controlled | Per coach |
| 8 | Safeguarding log (anonymised aggregate) for last 12 months | Compliance system | Continuous |
| 9 | Corrections log (file 10) | Public website + Evidence Room | Continuous |
| 10 | Privacy notice + data retention policy | Public website | Annual |
| 11 | Consent records for every named client / coach / participant quote | Evidence Room, access-controlled | Continuous |
| 12 | Sign-off trail: who approved each published report and when | Evidence Room | Per report |
Pre-assurance pack — what we hand over
Assembled within 5 working days of a request.
- Cover letter naming what is being assured, the methodology version, and the period covered.
- Walkthrough document — a single PDF that takes the assurer from raw data → outcome → discount → proxy → SROI → confidence factor for the headline number.
- Sample selection — 10 randomly drawn participant records (anonymised) with full audit trail from pulse submission through to final report inclusion.
- Methodology pack — files 01, 04, 05 with all linked Evidence Room references resolved.
- Coach-quality pack — files 01 and 08 from Sprint 7 plus the bench summary.
- Safeguarding sample — the most recent month's anonymised safeguarding log, with the warm-handoff scripts (Sprint 4 / 07) cross-referenced.
- Corrections log for the period.
- Sign-off trail for the period.
What we ask the assurer to test
We tell the assurer up front what we want stressed, so they don't waste budget on box-ticking.
- Can they reproduce the headline SROI ratio independently from the dataset?
- Do the financial proxies match the cited sources?
- Are confidence factors calculated consistently across reports?
- Is suppression applied uniformly?
- Are corrections handled within the 5-working-day policy?
- Are safeguarding patterns anonymised correctly?
- Does the consent trail hold up for every named individual?
What an assurance statement should look like
We accept assurance statements with:
- Scope: explicit list of what was and wasn't assured.
- Standard used: SVI Principles, ISAE 3000, B-Corp, internal-audit, etc.
- Assurer's findings, including any reservations.
- Recommendations.
- Assurer's name, accreditation, and date.
We decline assurance statements that are vague, paid-for-and-positive ("certified by X" with no detail), or that we wrote ourselves. If we wrote it, we'll sign it as a management statement, not as assurance.
Self-drill (quarterly)
Once per quarter, the Head of Impact runs a tabletop:
- Pick a published number from the last 12 months at random.
- Time the chain: number → report → working → dataset → raw row.
- Target: full chain reproduced in <2 hours, fully understandable in <1 hour.
- Anything missing or slow → fix this quarter, not next year.
Results logged. Patterns of slowness escalated to the board dashboard (file 06).
What we will not do for an assurer
- Hide a correction.
- Withhold a suppressed metric just because it would be inconvenient — we say it was suppressed and why.
- Re-state historical numbers without versioning.
- Provide raw participant data outside the consent envelope.
- Sign an NDA that prevents us from being honest in the annual report (file 03).