Presentation to sell assurance maps to senior management This brief slide pack is designed to provide practitioners with key bullets points and notes to help them sell the idea of assurance maps to senior management. Turn on Notes or view as Notes Page to access additional guidance. The presentation can be tailored to meet the needs of specific audiences and organisations.

Benefits: boards and senior management Summarises evidence on the effectiveness of the state of internal control versus known risks Helps to identify gaps in assurance needs Can be used to identify areas of over control Raises the understanding of the risk profile and strengthens accountability and ownership of control issues Enables oversight of all assurance providers and assurance activities Enables better use of assurance skills and resources Supports safer corporate reporting of risks, controls and assurance For a Board: This may be the first time the board has seen a structured factual analysis of the state of assurance against the main areas of risk. It enables them to start asking focused questions about the nature of the assurance and any residual risk and to consider whether the assurance meets their needs. In doing so it can of course identify gaps and overlaps. It can be used to help identify areas of over control from time to time. It should also have the effect of improving the level of understanding across the board and enable a clearer focus on accountability and ownership of risk and the assurance against it in each case. From this board analysis, the board will inevitably be able to maintain a greater degree of oversight over assurance and make better use of them. Lastly, it provides a factual basis to support public reports on the state of internal control: whether you are listed or in the public sector.

Benefits: risk and audit committees Factual high level summary of the state of assurance Enables better decision making, eg how better to use internal audit and other assurance providers against risk and where there are gaps Creates better evidence to support assurances provided to the board on the state of internal control Supports public reports on governance and statement of internal control Audit and risk committees often take the main burden for oversight of the state of internal control on behalf of the board. Assurance maps give them a tool to develop a better understanding of where the residual risks exist and to balance the focus of assurance work. In doing so, this should enable better decisions to be made about the deployment of assurance resources. The resulting updated map will provide the Board with a better picture of the state of internal control. As chairman of an audit and risk committee I would much prefer to have an assurance map to support my annual report to the Board on the state of internal control.

Benefits: internal auditors Enables the state of risk and internal control to be evaluated more quickly and effectively and in line with management perspectives Focuses effort on gaps in the assurance provided by first and second line of defences Provides independent assessment of the quality of assurance provided by assurance providers Creates a linkage of internal audit activity to risk and controls Provides a perspective on the state of internal audit relative to the assurance map Internal auditors need to be able to focus their plan of work on the areas of greatest concern for the board. All too often decisions are made about the focus of work which are then hard to relate to the organisation’s risk map and the views of the audit committee members and their concerns. The assurance map provides a very clear mechanism to support an open debate with the audit and risk committee members on the state of internal control. The rationale for selecting internal audits and their focus should be clearer for all to understand. The use of the map should also make clear to management the impact of the choices they have helped to make about the focus of internal audit work; and why there may still be significant residual risks in certain areas where the board has chosen not to apply internal audit resources. The linkage between risk, control and internal audit activity should be very clear as it is captured within the map.

Benefits: external auditors and assurers Identifies risk and enables a prompt focus on key issues likely to impact the external audit or other assurance engagements Provides a better understanding of the corporate view of the overall control environment Provides better understanding of the breadth and focus of internal audit activity relative to the overall risk and control environment Lastly, I will turn to external assurance providers. I’ll use auditors here as my shorthand since this is the biggest focus of activity. While the auditors will need to perform their own analysis of risk the assurance map should be a vital tool for them and help them to both: understand management’s analysis and concerns; and enable them to evaluate where they may be able to place reliance. So while the assurance map is essentially an internal tool, it is also a strong tool for external auditors and assurers.

Benefits of assurance maps: in summary Provides the audit and risk committee with access to a well-structured analysis of assurance to enable them to evidence, their satisfaction with the state of internal control Enables them to focus on specific areas of concern Boards will have evidence to support their assertions as to the state of internal control; vital for public reports All assurance related activities and resources can be better co-ordinated and directed to maximise the value of assurance activity To summarise: All the key players in the structure of an organisation can and should benefit from the creation of an assurance map It enables the audit and risk committee to discharge their responsibility for risk and internal control much more effectively and it leaves them with evidence of the decisions and the outcome. The resulting document enables the board to evaluate and challenge the work of the audit and risk committee to best effect and evidences publicly made statements about the state of internal control. Whether you are an internal or external auditor the map provides you with a factual basis for making decisions about the state of risk and control, and where to focus assurance resources.