Are senior leaders seeing the full assurance picture?
Senior leaders usually receive a wide range of information, including performance dashboards, risk and compliance updates, internal audit reports, external reviews, regulatory findings and certifications. The challenge is understanding what it collectively means.
Do leaders have a clear view of where they can take confidence, where concerns remain and what needs their attention? Or are they receiving separate reports and being left to bring the picture together themselves?
Why coordination matters
The Institute of Internal Auditors’ recent Statement of Position, Assurance and Advice in Support of Effective Governance, updates the Three Lines Model and places renewed emphasis on coordination between management, specialist functions and internal audit.
The IIA recognises that these roles provide different forms of assurance and advice. It also warns that independence should not lead to functions working in isolation. Better coordination can reduce duplication, address gaps and give leaders a more coherent and reliable view of risk and performance.
This does not mean that every function should work in the same way or produce a single combined report. Their different responsibilities, expertise and levels of independence remain important. However, separate activity should still contribute to a clear overall picture.
When the wider view is missing
We have seen internal audit plans that are well considered and focused on the organisation’s key areas of concern. However, there has not always been the same visibility of the work being carried out by risk, compliance, information security, external audit and other assurance providers.
This can make it difficult to see:
- whether several providers are reviewing the same area;
- whether important areas have received little scrutiny;
- whether conclusions from different providers are consistent; and
- what confidence the combined work should give senior leaders.
Often, the issue is not a lack of assurance activity. The wider picture simply has not been brought together.
More information does not always provide greater clarity
The volume of reporting can create a further challenge.
Board and committee packs can run to hundreds of pages. The information may all have a purpose, but leaders still need to identify the main messages, understand how different findings relate to one another and decide what action is required.
A report can be comprehensive without being clear.
Providing information is not the same as helping leaders understand:
- where they can take confidence;
- what remains uncertain;
- where conclusions conflict;
- what requires challenge or escalation; and
- what decision is being asked of them.
Detailed evidence may still be needed, but it should support the main message rather than obscure it.
Bringing assurance together
Assurance mapping can help organisations understand how their different sources of assurance fit together. HM Treasury’s The Orange Book: Management of Risk – Principles and Concepts describes it as a mechanism for linking assurance from different sources and considering whether its nature, coverage and depth are appropriate.
However, creating a map will add little value if it is rarely discussed. Its value comes from the conversations, challenge and decisions it supports.
What organisations should consider
Organisations looking to improve their overall assurance view should consider the following:
- Bring the sources together: Develop a proportionate view of the assurance provided by management, specialist functions, internal audit and external reviewers.
- Be clear about the confidence provided: Record what each source covered, when the work took place, its limitations and the independence of the provider.
- Identify gaps and duplication: Look for areas receiving repeated scrutiny and those where assurance remains limited.
- Make reporting decision-focused: Summarise what leaders need to know, what remains uncertain and what action or decision is required.
The aim is to give leaders a clear line of sight across the information already available.
When assurance is coordinated and communicated effectively, it can provide more than evidence that reviews have taken place. It can bring clarity to complex information and give leaders greater confidence to make informed decisions and pursue their organisation’s ambitions.
