Many internal control frameworks are better at answering yesterday’s questions than tomorrow’s.
- Did we comply?
- Did the process operate as intended?
- Were controls followed?
- Was the issue recorded?
These are important questions, and they will always have a place in good assurance work. Organisations need to know where controls are weak, where risks are not being managed effectively, where responsibilities are unclear and where evidence does not support the level of confidence being reported. But they are not the only questions that matter.
An organisation can be compliant, well controlled and still fail to achieve its objectives. It can have governance structures in place, documented controls, regular reporting and positive assurance opinions, while still missing the conditions needed for success. As we often say at Littlechild & Haley, organisations can sometimes be assured that they are compliant, but not that they will succeed. That is why we developed Success-Centred Assurance™.
Success-Centred Assurance™ is a disciplined, independent evaluation of whether an organisation is positioned to achieve its intended outcomes. Rather than starting only with controls and processes, it begins with purpose, strategy and the outcomes the organisation is trying to achieve. The key question becomes: are we managing the risks to success in a way that makes success likely?
Success depends on context
]In the modern business world, success is rarely defined by one measure. Commercial organisations talk about customer success, retention, trust, growth and long-term value. Public and regulated organisations think in terms of service-user outcomes, safety, access, quality and accountability. Internally, leaders are also paying closer attention to employee experience, operational resilience, technology, data, culture and the ability of teams to deliver under pressure.
This matters for assurance because every part of an organisation has its own version of success. A finance team, a customer service team, a technology team, a transformation programme and a board committee are not all trying to achieve the same thing in the same way. Success-Centred Assurance™ starts by understanding that context, then asks whether the right conditions, controls, behaviours and evidence are in place to support the outcome.
As Donna Littlechild, Co-Founder of Littlechild & Haley, explains:
“When we talk about Success-Centred Assurance™, we are not suggesting that assurance should become softer or less independent. It is almost the opposite. We are saying that assurance should be close enough to the organisation’s objectives to understand what success really depends on, and independent enough to challenge whether those conditions are genuinely in place. That means looking beyond whether a process exists, and asking whether it is helping people, teams and leaders deliver the outcome the organisation is trying to achieve.”
That distinction becomes clearer when we look at what success might mean in different parts of an organisation.
- For a customer team, success might mean customers getting the right outcome quickly, clearly and consistently.
- For a service delivery team, success might mean vulnerable users receiving a safe, reliable and accessible service.
- For a finance team, success might mean accurate reporting, timely decisions, strong controls and confidence in the numbers being used by leaders.
- For a technology team, success might mean resilient systems, secure data, reliable change management and services that support the organisation rather than frustrate it.
- For a transformation programme, success might mean benefits being realised, not simply milestones being completed.
- For a people or HR team, success might mean colleagues having the clarity, capacity, support and culture they need to perform well.
- For a board or committee, success might mean receiving information that is clear, timely and evidence-based enough to support good decisions.
None of these examples remove the need for risk management, controls, compliance or independent challenge. They simply place those things in context. The question is not only whether an activity is taking place, but whether it is contributing to the outcome the organisation needs.
Why foresight matters
The world is changing faster than many assurance models. Technology is evolving, workforce expectations are shifting, financial pressures continue to grow and regulatory requirements expand. Risks that seemed distant can become critical much sooner than expected.
In this environment, a control framework cannot simply be fit for today. It must remain fit for tomorrow.
This is what we mean by foresight.
Foresight is not about predicting the future. It is about understanding what could realistically threaten success and ensuring the organisation is prepared. It asks where pressures are beginning to build, what assumptions are being made, whether current governance and controls will still be effective in twelve months’ time, and whether leaders are receiving the early warning signs they need before issues become more difficult to address.
Imagine a healthcare organisation introducing an AI-powered patient triage system.
A traditional audit might conclude that the programme is well controlled because governance arrangements are in place, risks have been documented, milestones have been achieved and the system has gone live. On paper, the project appears successful.
Success-Centred Assurance™ asks different questions.
Do frontline staff have the confidence to use the technology effectively? Could workload pressures create workarounds? Are leaders receiving early warning signs if patient outcomes begin to deteriorate? Will the controls that exist today still be effective once the system has been embedded into day-to-day operations?
The greatest threat to success may not be a missing policy or control. It may be inadequate training, change fatigue, cultural resistance, unclear accountability or overconfidence in the technology itself. These are often the factors that determine whether an initiative succeeds or fails.
The question is not simply whether the project went live successfully. The more useful assurance question is whether the organisation is still positioned for success six months after go-live.
That is foresight.
Moving beyond tick-boxes
At the core of our approach are six principles:
- People before process.
- Looking forward, not just back.
- Layers, not lines.
- Assurance enables success.
- Trust over tick-boxes.
- Human judgement enhanced by technology.
These principles recognise a simple truth: most organisational failures are not caused by the absence of a policy. They arise because of leadership challenges, capacity constraints, cultural issues, behavioural pressures, poor decisions, weak information or unchallenged optimism. A truly effective control framework therefore looks beyond compliance and asks whether the organisation has the capability, culture, resilience and evidence needed to achieve its ambitions.
This is particularly important where organisations are delivering change, introducing new technology, responding to regulatory expectations or trying to improve services while maintaining control. In those environments, risk and success are closely connected. The question is not only “what could go wrong?” but also “what must go right?”
For boards, committees and senior leaders, Success-Centred Assurance™ can provide a more useful type of confidence. It can highlight where delivery is strong, where conditions are becoming more difficult, where confidence is justified and where success is being placed at risk by weak assumptions, unclear accountability or untested controls.
For internal audit, risk and assurance teams, it can also help frame work in a way that feels more relevant to the organisation. Assurance should not be seen only as a function that arrives after the event to identify deficiencies. At its best, assurance helps organisations improve the likelihood of success while there is still time to act.
This does not mean assurance becomes softer or more promotional. A success-centred approach still requires independence, evidence, challenge and professional judgement. It still asks difficult questions. It still reports uncomfortable findings where needed. The difference is that those findings are connected to the outcomes the organisation is trying to achieve.
If a major change programme is being delivered, Success-Centred Assurance™ might look at whether the expected benefits remain realistic, whether dependencies are being managed, whether the people affected by the change are being properly supported, and whether reporting gives a clear view of progress rather than simply a reassuring one.
If a service is being reviewed, it might look not only at compliance with process, but at whether the service is accessible, consistent, resilient and meeting the needs of the people who rely on it.
If a control framework is being assessed, it might look at whether controls are doing what they are meant to do, whether they still reflect the current risk environment, and whether management has enough evidence to support the confidence being reported. In each case, the assurance work is still grounded in risk and control, but it is also connected to success. That is what makes the approach useful.
Perhaps the most important question for any board, audit committee or leadership team is this:
Will our control framework still support success twelve months from now?
If the answer is uncertain, assurance has an opportunity to add real value.
Success-Centred Assurance™ helps organisations move from hindsight to foresight, from compliance to confidence, and from simply avoiding failure to actively enabling success. It is assurance designed not just for today’s challenges, but for whatever comes next.
Because good assurance does not just stop organisations failing. It helps them understand, evidence and protect the things that make success possible.
About Success-centred Assurance™
Success-Centred Assurance™ is a term developed and used by Littlechild & Haley to describe an assurance approach that starts with the outcomes an organisation is trying to achieve, then considers whether the right conditions, controls, behaviours and evidence are in place to support them.
It is designed to keep assurance connected to purpose: not only identifying what could go wrong, but helping leaders understand what needs to be true for success to be achieved
