Why NHS digital procurement is moving beyond testing to ongoing assurance

NHS procurement is moving away from lowest-cost decision-making toward a broader definition of value in public sector digital services - one focused on outcomes, resilience, and risk. In practice, that means suppliers aren’t just being judged on whether something works in principle, but whether it can actually be relied on in live NHS environments.

This shift is reinforced through approaches like NHS Supply Chain’s “Buy Smart” initiative, which emphasises sustainability, quality, and long-term impact alongside cost.
The implication is clear. Trust is no longer assumed at the point of procurement. It must be demonstrated through evidence of real-world performance.

Testing alone is no longer enough

Traditionally, suppliers have proved value through testing - showing that systems meet defined requirements under controlled conditions. That still matters. But on its own, it’s no longer enough.

Testing tells you whether something works as designed, but it doesn’t fully answer the question the NHS now cares about most: “Will it still work when it is used by real patients, in real conditions, under real pressure?”

Why “works in testing” doesn’t mean “works in practice”

NHS digital services operate in one of the most complex environments anywhere.

They’re used by people with different levels of digital confidence, across a wide range of devices, connectivity conditions, and accessibility needs. They also sit within wider clinical and operational pathways, where multiple systems and services are interconnected. In that context, systems can pass testing and still fail in practice, even after extensive functional testing across different environments. For example:

• A booking journey works in testing but breaks on older mobile devices, preventing patients from accessing follow-up care.
• An accessibility gap prevents a user from completing a critical step in a clinical pathway, which is why accessibility audits and disabled user testing are increasingly essential.
• A system performs well in isolation but slows under peak demand, delaying clinical workflows.

These are not edge cases - they’re everyday operational risks. And when they happen, the impact isn’t just technical - it disrupts patient pathways, increases pressure on services, and erodes trust in the supplier.

This is where assurance matters most. It’s not about replacing “testing” but going further. The focus should be on whether systems can be relied on in practice, over time. That means understanding how they perform under pressure, across different devices and user groups, and as things start to change with new integrations, usage patterns, and increased demand.

Assurance in this context is about understanding where things might fail - before they do.

Continuous assurance in a changing environment

One of the realities in the NHS is that nothing really stands still. Once a service is live, it changes. Systems get updated, integrations shift, usage grows or moves in ways you didn’t originally expect. And as that happens, the risk changes as well.

Continuous assurance is about recognising that.

It’s having ongoing visibility of how something is performing in practice, not just at the point it was signed off. And it means assurance becomes part of day-to-day delivery, rather than something that happens at the end. In practice, this means stepping back from testing individual features and looking at whole journeys, testing under more realistic conditions, and keeping that view as things evolve.

We’ve seen this approach work effectively with organisations such as the Department of Health and Social Care, where ongoing assurance has been embedded into live service delivery to support continuous improvement and help manage risk as services evolve. In that context, assurance becomes part of BAU delivery rather than a separate activity sitting alongside it. 

What this means for NHS suppliers

All this changes what “good” looks like. Passing tests and showing that something works under controlled conditions is no longer enough; real-world use is the new benchmark. That shifts what suppliers are expected to demonstrate. What matters now is whether a service continues to work once it’s launched and operational.

For suppliers working across the public sector and NHS, that means thinking beyond point-in-time testing. It means building assurance into day-to-day delivery, understanding how services behave in practice, and being able to identify and reduce risks as they evolve.
From an NHS perspective, the question has shifted. It’s no longer:

“Does it pass testing?”

It’s:

“Can we rely on this when it’s live, at scale, and under pressure?”

Ultimately, that’s what the NHS is buying: confidence that digital services will hold up in real use - not just in controlled test environments.

About Zoonou

Zoonou is a UK-based digital QA company. We work with NHS and wider public sector suppliers to embed structured, flexible quality assurance into delivery teams - helping them move beyond point-in-time testing, scale testing capacity, and build confidence that services will perform reliably in live, complex environments.