EXCHANGE OPTICS ← Research library
EXCHANGE OPTICS / ORIGINAL RESEARCH03 — 03

GOVERNANCE / INDEPENDENT ASSURANCE

Independent Assurance When the Customer Pays

BY EXCHANGE OPTICSRESEARCH NOTE 03 / THE INSTITUTION

The invoice should purchase an examination, not a predetermined verdict.

An independent marketplace assessment can be funded by the operator being examined. Who pays still matters, because payment creates leverage. What decides independence is whether the assessor controls the evidence, methods and conclusions, and can issue an unfavorable finding, or state that the evidence does not resolve the question, without customer interference.

Credible assurance protects the right to deliver an unfavorable or unresolved conclusion without having it rewritten, suppressed, or financially penalized.

This page concerns effective decision diversity: how many genuinely independent decision processes sit behind the bidders a marketplace counts. Research 01 explains why bidder counts don’t measure it.

The payer is not necessarily the decision-maker, but the precedents cut both ways

Established assurance systems offer useful, imperfect precedents. The SEC’s 2000 auditor-independence rule addressed contingent fees, where payment depends on a specified outcome and can give an auditor an economic interest in the client’s success [1]. That rule belongs to financial audit, but the conflict it targets is general.

The Media Rating Council shows a different structure: services seeking accreditation fund audits by independent CPA firms [2]. There the payer is the measurement vendor, not the party relying on the measurement, so it is a looser analogy to a marketplace operator funding its own review. MRC audit reports are also confidential to specified participants, so funding, examination and public disclosure are separate questions.

The strongest cautionary case is the issuer-pays model of credit rating agencies, widely criticized after the 2008 financial crisis because the rater’s revenue came from the party being rated. Payer identity does matter. What mitigates it is structure: who can dictate the evidence, tests and answer, and how dependent the assessor is on any one customer. A single-client business can face pressure even when its contract promises impartiality.

Independence has three parts

Organizational independence concerns appointment, conflicts, financial dependence and the power to replace an assessor or reviewer. Reviewers need relevant statistical, marketplace and source-system competence, access to challenge the work, and a documented right to disagree. Naming an external adviser does not establish independence.

Methodological independence concerns control over the question being estimated, populations, exclusions, competing explanations and failure criteria. A client may specify the commercial decision, operational constraints and lawful data boundary. The assessor must control whether the evidence warrants a result. A protocol documented before outcome inspection, with reasoned and versioned amendments, makes selective changes detectable.

Evidentiary independence concerns the underlying records. Can an independent source reviewer reconcile which auction opportunities were eligible, routed, invited, answered and included in an export? Can missing records be accounted for? Can the observation window, actor layer and sample be reproduced? A neutral reviewer cannot rescue a missing denominator.

These are related but not interchangeable. ISO/IEC 17029:2019 addresses competence, consistent operation and impartiality in validation and verification bodies, and accommodates first-, second- and third-party activities. Citing it does not establish that a provider is third-party independent, accredited or certified [3].

A simple auction example, and three possible explanations

Imagine an advertising marketplace with 40 nominal bidding entities and stable reported winner shares. The operator funds a review of whether those entities produce meaningfully independent decisions. The dataset contains only bids that survived several upstream selection steps.

Suppose the observed bids look unusually similar. Perhaps bidders share decision infrastructure. Perhaps they respond independently to the same changing market conditions. Or perhaps eligibility and routing systematically filter which bids reach the dataset. All three fit a reassuring participant count.

Before claiming hidden decision concentration, the assessor should request lawful, independently reconcilable records of the earlier stages, plus predecision context. Without them, the defensible answer may be UNRESOLVED: the decision-independence claim cannot be established from this source. That is a finding about what the evidence can bear. It is not evidence of collusion, shared ownership, a particular model vendor or financial damages.

UNRESOLVED must be earned

UNRESOLVED is the easiest outcome to defend and the least unwelcome to a customer, so it needs its own discipline. It is legitimate only when evidentiary criteria declared before the work are not met, for example an unreconcilable denominator or missing stage records. The report must name which criteria failed and what record would resolve the question. If the evidence is sufficient and contradicts the claim, the finding is FAIL, and UNRESOLVED may not be used to avoid it.

The contract must survive a negative finding

A customer may define the problem, limit authorized disclosure of confidential records, identify factual mistakes and submit additional evidence. The customer should not have a contractual right to veto a methodologically supported conclusion.

The GAO’s 2024 Government Auditing Standards list threats to independence including self-interest, self-review and undue influence, and direct auditors to assess an audited entity’s comments, explain disagreement when warranted and correct supported errors [4]. They don’t govern private marketplace engagements, but the separation between factual correction and control over conclusions carries over.

A workable agreement specifies six things before results are known: a declared claim and scope; lawful source access and traceability; a recorded analysis and challenge procedure; qualified reviewer, conflict and disagreement rights; evidence-based acceptance criteria; and payment independent of PASS, FAIL or UNRESOLVED.

These terms are not sufficient alone. The assessor needs the resources to complete and defend a negative report even if future business disappears, and any separate reviewer needs fee insulation from preferred findings. Confidentiality can restrict who sees a report, but it must not authorize a fabricated or silently altered report to the agreed recipients.

Buy decision quality in phases, not certainty in advance

A defensible engagement can begin with a bounded source/readiness assessment (R0): the relevant decision population, legal permissions, stage-by-stage data coverage, exclusions, reconciliation gaps and what conclusions are currently supportable. It is not numerical certification of independent competition.

Phasing creates its own conflict. If an assessor earns more when R0 concludes that further work is warranted, the finding carries a contingent-fee incentive. So R0 is priced as a fixed fee, stated in advance and identical whatever it finds. Whether to proceed is the customer’s decision alone, made under a separate written scope. A finding that further work is unwarranted is a complete deliverable.

Only where rights, source witnesses and qualifications permit should the parties separately authorize controlled field validation (R1): a synthetic canary run through the actual extraction path, independently checked source counts, predecision context and blinded tests. A field result should not be promised because a buyer signs a broader commercial agreement.

Later interpretation may connect supported findings to marketplace outcomes, but an associated change in revenue is not automatically a causal loss or realized saving. Monetary exposure needs a defensible baseline and assumptions. If the operator changes routing or auction controls, it should implement the changes itself or use a separate implementer, because an assessor that designed those controls must address the self-review threat before claiming impartial remeasurement.

An adverse answer may prevent an unjustified investment, clarify missing instrumentation or rule out a costly line of investigation. It does not automatically prove a return on fees, so the buyer should establish beforehand whether those decisions are materially valuable.

When another assurance provider is enough

Marketplaces already use internal analytics, fraud verification, supply-path assessment and established audits. These are real alternatives, and where one already examines the claim with complete evidence, additional assurance may be duplicative. The test is simple:

Does the incumbent examine the same decision-independence claim, using adequately complete evidence and independent challenge?

Exchange Optics is developing independent verification of effective decision diversity around one standard: the customer cannot buy a preferred answer. Our controlled research informs the method; external field qualification and independently constituted review are separate requirements before any conclusion can carry field assurance authority.

An assurance market earns trust when its unfavorable answers are as deliverable as its favorable ones.

Operators exploring a first engagement can learn about the Founding Design Partner pilot.

References

  1. U.S. Securities and Exchange Commission, Revision of the Commission’s Auditor Independence Requirements (November 2000) (https://www.sec.gov/rules-regulations/2000/11/revision-commissions-auditor-independence-requirements).
  2. Media Rating Council, Audit and Accreditation Process (undated institutional page; checked October 24, 2026) (https://mediaratingcouncil.org/about-mrc/audit-and-accreditation-process).
  3. ISO, ISO/IEC 17029:2019 — Conformity assessment: General principles and requirements for validation and verification bodies (October 2019; confirmed March 2025) (https://www.iso.org/standard/29352.html).
  4. U.S. Government Accountability Office, Government Auditing Standards: 2024 Revision (February 2024), §§3.30 and 6.58–6.61 (https://www.gao.gov/assets/gao-24-106786.pdf).