Certance Advisory · Quality Engineering
Certance makes quality measurable where it matters most: whether your tests protect the business, whether a green pipeline is real evidence, and whether you could prove it to a supervisor today. Independent, fixed scope, built for financial services and other regulated environments.
See the Coverage & Evidence AuditDefinition
A quality engineering consultancy assesses how well a team's tests protect the business, then closes the gaps that matter and leaves the team able to sustain the practice. Certance does this for financial services and other regulated software teams: we map your test suite to the business journeys that carry money, data and regulatory exposure, report where the evidence is thin for the questions an auditor asks, and size every recommendation to the next maturity level you can reach.
The discipline
Certance asks one question of every test suite: "do the tests prove the things the business depends on still work, and can you show that to someone who wasn't in the room?"
Producing that evidence is the discipline. And it matters more every quarter: AI agents now write a large share of production code, delivery speed has outrun verification, and quality engineering has become the accountability layer that proves software built at machine speed still deserves trust. We set out the full argument in The Certance Standard.
The Standard
The Coverage & Evidence Audit takes its journey tiers and scoring method from The Certance Standard, edition 2026.6. The Standard also defines five gates (provenance, test integrity, behavioural evidence, contract check and blast-radius match) that a change passes before merge, and sets out how a team shows that AI-assisted code has been verified.
The Standard runs to 42 pages. It is free to read without a form and published under a Creative Commons Attribution-NoDerivatives 4.0 licence. It is engineering guidance, with no legal advice and no compliance opinion.
Method
However mature your quality practice is today, the work follows the same discipline. What changes is where we start.
Identify the business journeys that carry the money, the data, and the regulatory exposure, and tier them by what failure costs. Quality effort follows the risk the journey carries.
Read the current state as it is: what the existing tests prove, what they only appear to prove, and where the silent gaps are. This is evidence work, measured against what the tests demonstrate.
Turn coverage into artefacts a third party can inspect: gap reports framed as business risk, coverage mapped to journeys, and evidence that traces to a release.
Close the gaps that matter, in priority order: test architecture, coverage of the critical journeys, continuous integration (CI) that produces evidence on every run, and AI-assisted generation where it holds up under enterprise conditions.
Leave the team with a practice they can run without us: documented standards, a knowledge base your team owns, and quality signals leadership can read without an interpreter.
Behind the method sits an eight-dimension maturity model: change capability, test and continuous integration health, knowledge architecture, engineering culture, dependency health and learning culture, with regulatory alignment and audit evidence posture for regulated teams. An engagement starts by placing the team on that model, and every recommendation is sized to the next step the team can reach.
The Quality Maturity read scores your team on those eight dimensions, and the AI Maturity Assessment scores seven dimensions of AI adoption.
Build applies Certance Lens, the open-source Playwright framework Certance publishes on GitHub under the MIT licence.
Founder
Certance is founded and run by Ivan Stepantsov, a quality engineering leader with 13 years in regulated software delivery across financial services, life sciences, and defence systems.
He is a Chapter Lead at a global investment bank, where he leads a team of quality engineers, owns the craft standard for the discipline, and assesses engineering quality across delivery streams. That is the environment Certance's method comes from: one where a missed test is treated as a business and regulatory risk, and where "trust me" has never been acceptable evidence.
Certance brings that standard to teams that need it, in fixed scope: the same rigour, the same evidence discipline, sized as a three-day audit. More about Ivan and Certance
Starting point
For teams with little or no structured quality practice: scale-ups hitting enterprise or regulatory expectations for the first time, or new products in regulated domains. We start at Map, define the quality policy and evidence model before any tooling, and stand up the practice in risk order, so the first tests written are the ones protecting the journeys that could hurt you.
For teams with an established suite and an uneasy feeling about it. We start at Measure: an independent read of what your current coverage proves, delivered as a gap report your leadership can act on. The question for these teams is which of their tests matter.
Not sure which applies? A scoping call settles it in 30 minutes.
Engagements
Fixed-scope engagements, so you know the cost and the deliverable before you start.
A three-day, independent read that maps your test suite to the business journeys that carry the risk, and shows where your coverage evidence is strong and where it is thin. It runs on what you export, with no credentials into your systems.
A structured assessment of how your team's quality practice is holding up as AI enters the delivery pipeline, with a regulatory overlay for environments regulated under the EU Digital Operational Resilience Act (DORA) and by the Financial Conduct Authority (FCA). See the assessment
The follow-on when the audit finds gaps worth closing: we build the missing coverage with your team, in risk order, leaving standards and documentation your engineers own from day one.
Ongoing quality engineering oversight for leadership: a quarterly independent audit plus a monthly check-in, so release risk and audit evidence stay visible as your systems and your AI adoption change. For teams that want the discipline without hiring for it.
Sample output
The audit ends in a written gap report. The sample report is built on synthetic data. It covers a suite of about 2,400 automated tests with a coverage dashboard at 87%, maps 12 business-critical journeys to the tests that guard them, and finds two adequately protected. Every gap is scored as Business Consequence (1 to 5) multiplied by Detection Delay (1 to 5), and five score Critical.
The report is written for the board and the risk function. It orders the gaps with Critical and High first and the cheapest fix first, shows each gap's tier and estimated effort, and names the first action to take.
Regulated delivery
Regulated delivery is the design constraint we start from, built in from the first day.
Supervisors have moved from asking firms to adopt DORA to checking that they follow it, and they ask to see the testing behind "our pipeline is green". We frame coverage as evidence from the start, so the artefacts exist before anyone asks. We advise on the engineering evidence; your compliance function owns the regulatory interpretation, and we'll say so every time it matters.
We read test code, reports and pipeline output that the client exports. We take no production access and never ask for client personal data. Where an engagement needs test data, it is synthetic. That is what makes an independent read possible inside your third-party risk appetite.
Every deliverable is written to be shown onward: to an auditor, a supervisor, a board. If a claim can't be traced to an artefact, it doesn't go in the report.
AI practice
The teams in trouble with AI-written code are the ones whose verification has not kept up with how fast they now generate it. Certance runs an AI-native practice with the discipline regulated environments demand.
We use an agent pipeline in which AI plans, generates, and heals tests, and every output passes a review gate before it ships. The rule behind it comes from The Certance Standard, edition 2026.6, which treats verification as the asset: AI output is a draft until verified.
Our framework decisions and patterns live in a versioned, documented knowledge architecture, so the method can be inspected and repeated.
Modern stack, web-first assertions, coverage mapped to journeys and reported with a taxonomy leadership can read. We go as deep on the engineering as your team wants, and we open with risk.
Audience
CTOs and Heads of Engineering get release risk in business language: which journeys are protected, which are exposed, and what that exposure costs.
Heads of Risk and compliance-adjacent leaders get testing evidence mapped to what DORA supervisors expect, for their compliance function to assess.
QA leads and engineering managers get an independent read that strengthens their case for investment, and a framework their team owns outright. An audit here gives you evidence for your roadmap.
Available
Certance Lens. UI Automation Framework. An opinionated Playwright and behaviour-driven development framework with an AI-agent skills base.
FAQ
It gives engineering leadership an independent read of what its tests prove. We map the test suite to the journeys that carry the most risk, such as payments, trading and reporting, show where coverage is structural only or absent, and produce a gap report a risk function can act on. Where gaps are worth closing, we build the missing coverage with your team, in risk order.
QA asks whether the software passed its tests. Quality engineering asks whether the tests prove what the business needs proven, and builds the systems that keep that true as the software changes. Quality engineering is an engineering discipline that runs through delivery.
No. Engagements run on exported artefacts: test code, coverage reports, CI output. Data minimisation is the default, which also keeps the engagement inside most third-party risk appetites without a heavy onboarding process.
Suite size tells you nothing about protection. Most suites are dense where the code is easy and thin where the business risk is. An independent read tells you which of your tests matter, and which journeys are silently unprotected.
A 30-minute scoping call: we identify your critical journeys and agree a fixed scope and fee before you commit to anything.
Start with a 30-minute scoping call, or go straight to the flagship engagement, the three-day Coverage & Evidence Audit.