Module 3.D

More documents

Recommendations

Info

3D.3 Assurance Mapping Senior management and the governing body receive assurance from various internal providers (e.g., management, internal control, risk and compliance, and internal audit) and external providers (e.g., SAI, inspectors, and other consultants). An assurance map is used to record which party is providing assurance on each group of key risks and control to avoid unwanted gaps and unnecessary overlaps and duplication. Some gaps may be deliberate, especially where management regards those risks as being of a lower priority or controls are known to be reliable and effective. Likewise, some overlap and duplication is intentional for high risk areas, new risks, or areas requiring a high degree of specialist expertise where a second opinion is valued. Assurance mapping can also help with audit fatigue which can arise in teams subject to multiple reviews, inspections, and investigations in a relatively short period of time. Assurance provides can collaborate on timing to minimize this danger. Alternatively, two audits may be conducted together. Internal audit may use the map to inform their planning and determine whether there is scope to use the work of other assurance providers rather than repeat it. Management may use the map to ensure resources and structures are being utilized with the greatest efficiency and effectiveness. The internal audit function is well laced to create such an assurance map. The IIA guide Coordination and Reliance: Developing an Assurance Map suggests five steps for producing an assurance map: 1. Identifying sources of risk information. 2. Organizing risks into risk categories for consolidated viewing. 3. Identifying assurance providers. 4. Gathering information and documenting assurance activities by risk category. 5. Periodically reviewing, monitoring, and updating the assurance map. 49 A further advantage of the assurance mapping process is it requires assurance providers to share information with each other and thus help to create a more coherent view of the organization. An assurance map can take many forms. It will likely reflect the risk categories adopted by the organization and used in the risk register. An example assurance map is shown below. The example does not include external assurance providers which should be considered for a comprehensive picture. 49 Coordination and Reliance: Developing an Assurance Map, The IIA, 2018. 78
79
Page 1 and 2: 3D. CFO, Internal Audit, and Extern
Page 3 and 4: In the public sector of some countr
Page 5 and 6: • Ensure that those making decisi
Page 7 and 8: • Identifying and equipping finan
Page 9: According to Standard 2050 - Coordi
Page 13 and 14: References and Additional Reading 1
Page 15: The Practice of Internal Controls,

Module 3.D

Create successful ePaper yourself

Delete template?

Save as template?