Quality engineering for regulated software
Certance Advisory makes the gap visible. A fixed, independent audit maps your test suite to the business journeys that carry the risk, and tells you whether you could prove it to a supervisor today.
See the Coverage & Evidence AuditThe problem
A green test run proves the code did what the test expected. Whether the test checked what the business depends on is a separate question: a portfolio screen can render perfectly, every test green, and still show the wrong balance. AI now writes more of that code, faster than any suite can follow. The EU Digital Operational Resilience Act (DORA) has applied since 17 January 2025, and 2026 is the first full year of supervision. Supervisors have moved from asking firms to adopt DORA to checking that they follow it, and they ask firms to show their testing.
Approach
Coverage where failure costs the most. We rank every critical path, in the interface or behind it, by what a failure would cost the business. Coverage is judged against this map.
Tier 1
Failures that move money, expose data, block access, or cannot be undone.
Tier 2
Failures that stay silent, where the system returns an answer that looks right and is wrong.
Tier 3
Operational friction.
A structured read of how a team manages quality, scored across Change Capability, Test and CI Health, Knowledge Architecture, Engineering Culture, Dependency Health and Learning Culture, plus Regulatory Alignment and Audit Evidence Posture for regulated teams.
In regulated financial services, your risk function or a supervisor may examine the test record closely. Certance findings are written to be checked.
We speak the language your risk function already uses: DORA Article 24(6) testing evidence, FCA Important Business Services, test data exposure, and release records that are retained and traceable. Findings arrive as an independent view of regulatory risk the business can act on.
Advisory
Three days
An independent, risk-mapped picture of what your tests protect, and whether you could hand a supervisor the evidence today. Framed for engineering leadership and the board.
Where it matters, the audit goes further: an eight-dimension read of how your team manages quality, with a regulatory overlay for DORA and FCA-regulated environments.
Ongoing assessment and a monthly check-in. Quality risk, tracked as your systems change.
The audit
A three-day engagement that maps your test suite to the business journeys it is supposed to protect.
A business-readable gap report, written for a Head of Risk to act on:
Journey coverage table, mapped to Tier 1, 2 and 3 business risk.
Top five gaps, ranked by consequence.
Evidence posture check: whether your test records are retained, traceable to a release and durable enough for a supervisory look-back.
The assessment is independent, so your risk function can weigh it as a third-party view.
A fixed, three-day engagement, with scope and fee agreed before you start.
Day 1
Discovery interviews and a full test suite inventory
We interview your engineering and QA leads and inventory every test you run, working from an artefact bundle your engineer exports and reviews. The audit never touches your systems.
Day 2
Business journey mapping and risk-tier gap scoring
We map your business-critical journeys and score coverage against Tier 1, 2, and 3 risk.
Day 3
The risk-framed gap report, delivered
You receive a business-readable gap report: what is protected, the top gaps, and what to fix first.
It runs on test artefacts your own engineer exports and reviews before anything leaves your environment: test names and assertions, pipeline configuration, recent run summaries, coverage output. No account provisioning, no production data, no customer data. For most vendor-risk frameworks this is the lowest access tier a supplier can occupy.
If the audit leads to implementation work, access for that is scoped separately under your own onboarding rules, once the audit is delivered.
Insights
Original research and worked examples of what an engagement produces. Subscribe to get new work as we publish it.
Standard
The Certance Standard
Edition 2026.6: fourteen chapters, from the five merge gates to testing AI inside the product, and the twelve statements. Free to download.
Read the StandardSample report
Coverage gap report
The exact artefact a client receives, built on synthetic data: a journey-by-journey map of coverage and where the gaps are.
See it on a scoping callGuide
AI Token Efficiency Guide
How regulated engineering teams cut AI-tool spend without losing capability.
Read the guide