Independent assurance over system design and effectiveness