Averian SWAT — Software Analysis & Test

The method

Four activities, in balance.

“We have testers. We are trying Agile. We have bought an automation tool. And we are still not confident that what we release will work.”

Averian SWAT is our flagship methodology. It holds that useful software quality work comes from four activities in balance, each answering to a different stakeholder — Formal to management and the regulator, Analysis to the business, Exploratory to the end user, Automation to the developer. Each has a characteristic failure when it runs alone, and most organisations are strong in one and blind in the other three.

We establish the context first, then set the balance to fit. Delivery is by a POD — a small, dedicated, cross-skilled team accountable for an outcome, not a set of individual placements — working to a dashboard built with you from metrics you already use.

Agency, Agile and automation are the three standard answers to a quality problem. Each is sometimes part of the answer and none is sufficient alone.

Start here

One day, or one week.

Both are small enough to approve without a business case, and both end with a costed recommendation.

The Heat Map

One day. A picture of where your quality risk actually sits.

“We are about to spend a great deal on testing this release, and I could not tell you with confidence where the real risk is. Different people in this business would give you different answers.”

A one-day facilitated workshop that produces a single-page, colour-scored map of quality risk across your system, product or portfolio. Your own people build the map. We facilitate and contribute nothing to its content — which is precisely why it holds up when it is challenged inside your organisation.

A single-page Heat Map that goes into a board pack unchanged.
A full attribute, component and capability inventory — a reusable test basis whether or not you work with us again.
A prioritised story list with the weightings and the reasoning behind them.
A named risk register of the red areas, and a recommended next step, costed.

Duration One day on sitePack Three working daysPrice Fixed

Why Averian. Most assessments tell you what a consultant thinks. A Heat Map tells you what your own people think, laid out so it can be argued with, agreed and acted on. It is how most Averian relationships begin.

Book a Heat Map day

Testpresso

A short, intense burst of testing. A quick shot of reassurance.

“We go live in three weeks and something about this release is bothering me. I do not need a programme. I need somebody good to look at it, this week.”

A fixed-scope, fixed-price burst of expert testing at short notice. Two to five days, no ramp-up, no discovery phase — we start testing on the first morning. Delivered in capsules: UI, UX, API, database, key feature, performance, automation or GxP.

A findings pack that answers your stated worry on page one, then everything else by severity.
Defects raised in your own tracker, reproducible, as we find them.
The questions we could not resolve, listed separately and honestly.
A recommended next step — or a clear statement that it held up.

Duration Two to five daysNotice Days, not weeksPrice Fixed, never varied

Why Averian. Small enough to approve without a business case, and delivered by the same calibre of person you would get on a twelve-month programme. If what we find is structural rather than local, we will say so and tell you what a proper answer would cost.

Ask for a Testpresso this week

Finding what matters

Targeted work, where the risk actually is.

Requirements Review

Are these good enough to build from without generating rework?

“Estimates are being disputed and nobody can say why they differ. We suspect the requirements are the problem, but that is an uncomfortable thing to assert without evidence.”

A structured review of an existing requirement set, scored against a defined set of challenges, establishing the risk those requirements carry into delivery. We read the set twice — once as the person who has to build from it, once as the person who has to prove it was built. The gap between those readings is most of the finding.

A scored review with the evidence cited against every score.
A ranked list of the weaknesses that most threaten delivery.
An assumption log — what the document takes for granted and has not tested.
A rewrite list, and where you want one, a revised estimate you can defend.

Duration Four to twelve hours of sessionsTeam One senior consultantPrice Fixed

Why Averian. This is a review of a document against a standard, never an assessment of anybody’s work — and we say so to the author in writing before we start. That is why people engage with the findings instead of defending against them.

Get the requirements scored

Most Feared Bug

If one defect in this system could cost you millions — is it there?

“The audit committee asked what our worst-case technology failure would be, and whether we had looked for it. We did not have an answer.”

A hard target search. A small senior team, a fixed timebox, and a single fault whose existence is not certain. Conventional testing asks whether the system works; this asks what would hurt most, and then goes looking for that specifically. You cannot test every possible scenario — but you can, when you are looking for one instance of one defect.

A definitive report — found, or not found — with the full trials log as evidence.
Automation of the key paths examined along the way.
Non-functional testing that would not otherwise have been scheduled.
A permanent yardstick, and a dry run of your crisis process under controlled conditions.

Duration Three to six weeks, fixedTeam Small and seniorPrice Fixed against your own exposure figure

Why Averian. We tell you before we start, in writing, that we may not find it and that not finding it proves nothing. Clients buy this service because we say that first. A firm that promises to find it is selling you something else.

Define your most feared bug

Building capability

Automation that pays back, and your own people able to sign off.

Automation in 13 Weeks

Thirteen weeks to be impressed — with the option to stop at each checkpoint.

“We bought an automation tool. Two years on we have a suite nobody trusts, and I cannot tell you what it has saved us.”

A thirteen-week programme running the Analysis, Exploratory and Automation quadrants in parallel, with three formal checkpoints. At each checkpoint you receive a dashboard, a return-on-investment position, and an explicit set of costed options — including the option to stop.

Front-end and back-end automation framework code and executables, plus bespoke test data tools.
Automation running on demand, on build, on deployment and as nightly regression.
A demonstrated, measured return on investment — actual, not projected.
Your team trained in the approach and able to continue without us.

Duration Thirteen weeksCheckpoints Three, each a decisionExit Available at every checkpoint

Why Averian. Every checkpoint carries a business case and a stated option to stop. An automation programme that cannot show a return by week thirteen should not be renewed, and we would rather be the ones who say so.

See the thirteen-week shape

BUATcamp

Your own experts, able to test and sign off their own systems.

“User acceptance testing keeps missing the mark. The users neither test nor accept — because they know they have not really tested. The business does not know testing and the testers do not know the business. Everyone waits.”

A two-day programme that leaves your business users able to plan, run and sign off their own user acceptance testing — built entirely around your real system and your real programme. You hired excellent people who know your processes inside out. What they lack is the testing skill, so we move the skill, not the responsibility.

A completed UAT plan for your actual programme, built during the camp and owned by your coordinator.
Test cases written by your own people, reviewed by ours.
Any defects found during the camp — there are always some.
An honest note to the sponsor on how ready the business really is.

Duration Two daysGroup Eight to sixteen business usersPrice Fixed

Why Averian. Training external testers in your business costs time and money every time. Training your own experts to test is a one-off investment that pays back on every system you introduce afterwards.

Run a BUATcamp

Regulated environments

Where the question is not only whether it works, but whether you can prove it.

Averian has worked inside externally inspected environments for two decades, to GAMP 5, 21 CFR Part 11, EU GMP Annex 11 and ALCOA+.

Validated Delivery

Audit-ready evidence as a by-product, not a project at the end.

“Every change carries a documentation burden. Our team spends more time evidencing than testing, and we still assemble the audit pack in a panic at the end.”

Independent validation and verification for organisations delivering change in regulated environments. We work to the frameworks your inspectors work to — GAMP 5, 21 CFR Part 11, EU GMP Annex 11 and ALCOA+ data integrity expectations — on the principle that the evidence should be a natural yield of the method rather than a reconstruction at the end.

A complete, traceable, inspection-ready artefact set — plan, traceability matrix, risk assessment, executed IQ, OQ and PQ protocols, deviations, summary report.
A working change-control position that maintains the validated state after go-live.
Vendor and supplier evidence assessed and leveraged rather than repeated.
An honest read on whether evidencing is crowding out real testing, at every checkpoint.

Runs With the deliveryStandard Yours, plus the applicable regulationTeam Formal QA within the POD

Why Averian. Auditors are reassured by problems found and resolved; they are not reassured by a perfect record. We build the pack in your format, not ours — an audit pack in your own templates is defensible; one in ours invites a question.

Talk to us about your validation load

CSA Transition Review

Move to risk-based assurance — and be able to defend it.

“We know the regulator now expects a risk-based approach and that much of our scripted testing adds no assurance — but nobody here wants to be the one who reduces the documentation.”

A structured review of how your organisation assures computerised systems, and a route from document-led validation to Computer Software Assurance. CSA does not lower the bar; it moves effort to where the risk is. The hard part is not understanding that — it is being able to show an inspector why you reduced what you reduced.

A current-state read of validation effort against assurance obtained, with the ratio stated plainly.
A risk classification framework built by your people and signed by your quality unit.
A target assurance model — what is scripted, what is explored, what is leveraged, with the rationale recorded for each.
A transition plan naming the procedures, templates and training that must change.

Basis FDA CSA guidanceBuilt by Your people, signed by your quality unitPrice Fixed

Why Averian. A reduction you cannot explain is a finding. A reduction with a recorded, risk-based rationale is the guidance working as intended. The rationale is recorded as each decision is taken, not written up afterwards.

Review your assurance position

Independent assessment

An honest read on the delivery system, and on your AI.

Quality Maturity Assessment

Is this a project problem, or is it the way we build software?

“The same issues keep appearing on different projects with different teams. I need evidence, not opinion, before I ask the board for investment.”

An independent assessment of how your organisation actually delivers software quality, scored across four dimensions with a costed improvement path. It is an assessment of the delivery system, not an audit of the test team — and most findings sit upstream of testing, which is usually the point.

Your maturity position, with evidence for every finding.
Findings reported without attribution, so people tell us the truth.
A sequenced, costed improvement path.
A first step that can be completed in eight weeks — because a path beginning with an eighteen-month programme never gets started.

Duration Five to ten daysAccess Interviews plus observationPrice Fixed

Why Averian. We will score it honestly, including where that is uncomfortable, and you will see it before anybody else does. A flattering assessment is worthless to you and damaging to us.

Commission an assessment

AI Assurance Review

Could you demonstrate this to a regulator, an auditor or a court?

“We have put an AI capability into a process that matters. Somebody is going to ask how it is controlled, and I am not confident we could answer.”

An independent review of an AI-enabled system and of the delivery process around it. A model-driven system frequently has no single correct output, only a distribution of acceptable ones — so the first deliverable is not a test plan. It is an agreed, written, measurable definition of acceptable behaviour, signed by your business rather than by the people who built the system.

A written, measurable definition of acceptable behaviour, signed by your business.
An AI Heat Map across training data, model, prompt and context, retrieval, guardrails, human review and telemetry.
A findings and risk report organised around defensibility.
A recommended evaluation and monitoring approach, with a named owner.

Duration Five to ten daysBasis Independent — we do not build or sell AIPrice Fixed

Why Averian. Almost everyone offering an opinion on your AI is also selling you AI. Averian is not. Independence is the entire product here, and we will decline the work rather than compromise it.

Get an independent read on your AI

Ongoing support

Senior experience, on tap.

Bug Buddy

A senior tester in your corner, for the weeks when it is hard.

“My test lead is good and under pressure, and there is nobody senior for them to ask. When something difficult comes up, they are on their own.”

A hands-on senior tester, retained, available to mentor, support and strengthen your own test team. It is a safety net and a sounding board — bought by the person doing the work rather than by a sponsor, which is why it tends to last.

Senior experience available when it is needed, without a permanent hire.
Best practice demonstrated on your own work rather than taught in the abstract.
Specialists reached in — automation, IoT, security, AI — when your team hits something outside its depth.
Results shown through tangible metrics on a dashboard, not a feeling that things are better.

Typical Two to four days a monthTerm Three to six months, reviewedPrice Monthly retainer

Why Averian. “What do we do now? Wouldn’t it be great if we had access to someone with experience of this exact situation.” That sentence is why this service exists, and it is usually the test manager who says it.

Put someone in your team’s corner

Tell us the problem. We will tell you the first step.

Not a proposal, not a pitch deck — a short conversation, then a written view of how we read it and what we would do about it.

Book the first step