Living Assurance Case

Problem addressed

A validation conclusion becomes stale when it is stored only in the release package.

Limitation of existing practice

Periodic review may discover drift long after a control or assumption changed.

Proposed method: inputs and steps

1. Define the top-level fitness claim.
2. Decompose it into risk and control arguments.
3. Link current evidence and assumptions.
4. Assign owners and freshness requirements.
5. Trigger reassessment when evidence, context, or controls change.

Decision outputs

• Versioned assurance case
• Evidence freshness view
• Open assumption register

Worked example

A cloud data platform case updates automatically when interface reconciliation fails, a critical supplier control changes, or a new data domain enters scope.

When to use—and when not to

Use when: Systems with continuous delivery, complex interfaces, AI, or rapidly changing suppliers.

Do not use as-is when: Very simple, static, low-risk tools where maintenance overhead is disproportionate.

Limitations

Needs disciplined ownership and integration with change and incident processes.

Inspection questions

• Which claims depend on supplier evidence?
• How is stale evidence identified?
• What event last changed the case?