Module 3.D

3D.3 Assurance Mapping
Senior management and the governing body receive assurance from various internal providers
(e.g., management, internal control, risk and compliance, and internal audit) and external
providers (e.g., SAI, inspectors, and other consultants). An assurance map is used to record
which party is providing assurance on each group of key risks and control to avoid unwanted
gaps and unnecessary overlaps and duplication. Some gaps may be deliberate, especially
where management regards those risks as being of a lower priority or controls are known to be
reliable and effective. Likewise, some overlap and duplication is intentional for high risk areas,
new risks, or areas requiring a high degree of specialist expertise where a second opinion is
valued.
Assurance mapping can also help with audit fatigue which can arise in teams subject to multiple
reviews, inspections, and investigations in a relatively short period of time. Assurance provides
can collaborate on timing to minimize this danger. Alternatively, two audits may be conducted
together.
Internal audit may use the map to inform their planning and determine whether there is scope to
use the work of other assurance providers rather than repeat it. Management may use the map
to ensure resources and structures are being utilized with the greatest efficiency and
effectiveness.
The internal audit function is well laced to create such an assurance map.
The IIA guide Coordination and Reliance: Developing an Assurance Map suggests five steps for
producing an assurance map:
1. Identifying sources of risk information.
2. Organizing risks into risk categories for consolidated viewing.
3. Identifying assurance providers.
4. Gathering information and documenting assurance activities by risk category.
5. Periodically reviewing, monitoring, and updating the assurance map. 49
A further advantage of the assurance mapping process is it requires assurance providers to
share information with each other and thus help to create a more coherent view of the
organization.
An assurance map can take many forms. It will likely reflect the risk categories adopted by the
organization and used in the risk register. An example assurance map is shown below. The
example does not include external assurance providers which should be considered for a
comprehensive picture.
49
Coordination and Reliance: Developing an Assurance Map, The IIA, 2018.
78