An assurance map is an invaluable tool to help internal audit communicate clearly with the audit committee. Assurance is complex and internal audit is just one source that the audit committee relies upon; understanding who provides assurance over what and where the gaps are is critical for robust oversight of the organisation.
The COVID-19 crisis has thrown organisations into disarray; imagine for a moment you are a member of the audit committee providing oversight at the moment…what and who can you trust?
Internal audit can provide a simple, relevant and easy to read table on a page that guides the audit committee to answer this question: an assurance map.
Let’s take a quick look at what an assurance map is, the benefit of having one and how you can create one today.
A well-constructed assurance map focuses on the key risks to the organisation, the sources of assurance and the level of comfort provided. It can also focus on key controls.
In addition to independent assurance over key risks, as appropriate internal audit should also provide assurance over the quality of first and second-line assurance providers.
An assurance map is visual and can be used in a variety of ways from presenting a basic picture of assurance resources.
Or it could be used to present the latest set of assurance results in a visual way, including the trend.
Even without any knowledge of the risks or the organisation, using this example it is possible to ask:
A useful toolkit is freely available from RSM, designed for the education sector. The guidance and templates provided as part of the toolkit are easily transferable to any organisation. Appendix 5 is a good example of how to summarise assurance information for the audit committee.
An assurance map brings an organisations risk appetite to life. At the same time as highlighting assurance gaps, it also shows where there is duplication or too much assurance. It is a simple way of aligning assurance resource, risk and internal control.
It improves awareness of the control environment by looking across the organisation rather than at individual reports which can lead to siloed thinking.
It drives positive behaviours by enabling robust discussions about risk, educating on the value of assurance and aiding collaboration between functions.
Collectively, the assurance community of an organisation often has a more powerful voice when it works together; an assurance map is a practical platform benefiting all parties.
It also supports Performance Standard 2050.
ICAEW has a comprehensive 10 step approach to producing an assurance map. This is an ideal world approach and may take too long and be too resource intensive during the current crisis. It can be adapted and where relevant data is not readily available, a prudent approach should be taken to produce a basic document. It is better to begin than not to start…it can be refined in the weeks to come with the support of the business and the audit committee.
We suggest a simplified approach to create a ‘starter for ten’ today using internal audit knowledge.
In addition to member guidance on the topic, the Institute has created a virtual course on assurance mapping taking place in June 2020. All courses are open to non-members.
The following guidance is only available if you are a member of the Chartered IIA:
Standard: 2050 Coordination and reliance
Implementation guidance: 2050 – Coordination and reliance
Supplemental guidance: Coordinating risk management and assurance
Guidance - Coordination of assurance services