Glossary term
Combined Assurance
Subject: Governance, Internal Control and Audit
Also known as: Integrated Assurance
Combined assurance is the coordination of the different assurance providers inside and outside an organisation, so that the board gets one joined-up view of how well the main risks are controlled.
Explanation
Large organisations are checked by many parties: managers, risk and compliance teams, internal audit, external auditors, regulators and specialist reviewers such as safety or quality inspectors. Left alone, they overlap in some areas and leave gaps in others, and the board receives separate reports that are hard to compare. Combined assurance maps each significant risk to the people who give comfort over it, judges how reliable each source is, and arranges the work so that gaps are filled and duplication is cut. The output is usually an assurance map presented to the audit committee. It builds on the Three Lines model but also brings in external sources. You meet it in annual audit planning and in board reporting, and it is promoted in some national governance codes, such as South Africa's King Code. Directors can only rely on assurance they can see, so an assurance map shows which comfort is real and which is assumed.
Example
A manufacturer finds that its plant safety is reviewed by the site team, a corporate safety function, an insurer's surveyor and internal audit, while product recall readiness is reviewed by nobody. The audit committee asks for an assurance map. Internal audit drops a duplicate safety review and takes on recall readiness, and the committee now sees one table covering both.
Not to be confused with
- Three Lines of Defence Model
- The model assigns roles in managing risk. Combined assurance coordinates the evidence those roles and outside parties produce.