An assurance map is a table that shows, for each of an organization’s significant risks, who provides assurance over it and how much that assurance can be relied on: management’s own monitoring in the first line, the risk, compliance and other functions in the second, internal audit in the third, and the external auditors, regulators and certification bodies outside. Its purpose is to let the board see where assurance is strong, where it is duplicated and where it is missing, and to let internal audit coordinate with and rely on the other providers as the Global Internal Audit Standards expect (Standard 9.5 on coordination and reliance). The IIA’s practice guidance on developing an assurance map describes the method; what practitioners ask for and rarely get is a finished one, because a real map describes an organization’s weaknesses in a single picture and nobody publishes theirs.
This guide builds a map from a blank page and publishes the result. It covers the six steps (define the rows, inventory the providers, define the coverage ratings, assess and evidence each cell, find gaps and overlaps, present and govern), the design choices at each (categories or key risks as rows; how many providers to show; how to rate coverage without flattering it), the completed map for Brightwater Foods, the $180 million manufacturer used in examples across this site, with twenty risk categories and six providers, the eleven decisions the map produced, how Lakeshore Bancorp scaled the same method to 126 audit universe entities and four assurance functions, the board view, how the map supports internal audit’s reliance decisions and plan, the failures that make maps decorative, and the governance that keeps a map current. It is the document that settles the overlap zones described in the four functions guide and the input to the plan.
In this guide
- What the map is for, and the Standard behind it
- Step 1: define the rows
- Step 2: inventory the assurance providers
- Step 3: define the coverage ratings
- Step 4: assess and evidence each cell
- Step 5: find the gaps and overlaps
- Step 6: present the board view and govern the map
- Variants of the map, and running the workshop
- Template: the cell record
- The completed map: Brightwater Foods
- The decisions the map produced
- Scaling the method: Lakeshore Bancorp’s 126 entities
- How the map supports internal audit’s reliance and plan
- Failures that make maps decorative
- Questions about assurance mapping
- Related guides
What the map is for, and the Standard behind it
| Reader | Question the map answers | Decision it supports |
|---|---|---|
| Board and audit committee | Where is our assurance strong, duplicated or missing? | Whether the combined assurance over the top risks is adequate; where to direct internal audit and the second line |
| Chief audit executive | Which risks can internal audit rely on others for, and which can only internal audit reach? | The plan’s coverage; the reliance decisions Standard 9.5 requires to be assessed and documented |
| Second-line heads | Where does our work duplicate another function’s, and where does the board need more from us? | Monitoring and testing plans; resourcing cases |
| Management | How many times will each control owner be asked for the same evidence? | Request coordination; the shared calendar |
| External assessors and regulators | Does the function coordinate and rely on a documented basis? | Conformance with 9.5; examiner reliance on the function |
The Standards require the chief audit executive to coordinate with other assurance providers and, where relying on their work, to assess their competence, objectivity and the quality of the work and to document the basis for reliance; the map is the natural artifact for both, and external quality assessors (the EQA guide) ask for it under that standard. The Three Lines Model supplies the provider structure; the taxonomy supplies the rows.
Step 1: define the rows
Rows are the things assurance is provided over, and the choice is between risk categories (the taxonomy‘s level-2 categories, typically 20 to 40) and specific risks (the top 20 to 30 from the register). Categories give a stable map that survives register changes and reads well at board level; specific risks give a sharper map that answers “who assures us about ransomware” rather than “who assures us about technology risk”. Most organizations start with level-2 categories and add a second view for the top ten register risks once the first works. A third option, used by functions with a mature universe, is to map the audit universe entities themselves, which is what Lakeshore did at 126 rows; it serves internal audit’s planning directly but is too granular for a board. Whatever the row, it must be one the providers can answer about: a row called “strategic risk” produces shrugs, while “strategy execution and major investment decisions” produces a list of who reviews the business cases.
Step 2: inventory the assurance providers
| Line | Provider type | Examples | What counts as assurance from it |
|---|---|---|---|
| First line | Management monitoring | Supervisory review; reconciliations; KPI and exception monitoring; self-assessment; quality control in operations | Structured, evidenced monitoring with defined coverage; not “the manager keeps an eye on it” |
| Second line | Risk, compliance and specialist functions | ERM; compliance monitoring and testing; the SOX program office; credit review; model validation; health and safety; information security; quality assurance (food safety, ISO systems) | Independent of the first line it oversees; testing or monitoring with a method and results |
| Third line | Internal audit | Engagements, continuous auditing, issue validation | The function’s own work, rated by its last coverage date and result |
| External | Independent outside parties | External auditor (financial statements, ICFR attestation); regulators (examinations); certification bodies (ISO, food safety schemes, SOC reports received); customer audits; insurers’ surveys | Work whose scope and results the organization has seen; a certificate alone is limited |
The inventory lists every provider, its scope, its method, its independence and the period of its last work, gathered by interviewing each function and reading its plan and reports. Five to eight providers fit on a page; organizations with more group them (all second-line risk functions in one column with the specific function noted in the cell). The distinction that matters is between assurance and activity: a function that performs a control is not assuring it, and a certificate on the wall is assurance only to the extent the organization has read the assessor’s scope and findings, which the SOC 2 report review guide makes the point about for vendors.
Step 3: define the coverage ratings
| Rating | Criteria (all must hold) | Shown as |
|---|---|---|
| Substantial | The provider’s work covers the main risks in the row with a documented method; it is independent of the activity; results are evidenced and reported; the work is current (within the row’s cycle, usually 12 months); internal audit has assessed the provider’s competence and objectivity where it intends to rely | S |
| Moderate | Covers part of the row, or covers it with a less rigorous method (monitoring rather than testing), or is somewhat dated, or independence is partial | M |
| Limited | Touches the row incidentally; informal; not evidenced; or more than two cycles old | L |
| None | No work by this provider on the row | blank |
| Not applicable | The provider could not reasonably assure this row | n/a |
The ratings describe coverage, not results: a Substantial cell means the risk is well assured, not that it is well controlled (the provider may have found it badly controlled). The combined assessment for the row, in the final column, is a judgment from the cells: Adequate where at least one Substantial independent source exists and the first line monitors; Partial where only Moderate or first-line coverage exists; Gap where nothing reliable exists. Written criteria are what stop the map from flattering its authors, because every function believes its own coverage is substantial, and the criteria should be agreed with the provider heads before any cell is rated so that the argument is about evidence rather than about the scale.
Step 4: assess and evidence each cell
Each cell is rated against the criteria with a reference to the evidence: the engagement report, the monitoring plan and results, the certificate and the assessor’s report, the regulator’s letter, the RCSA. Internal audit usually facilitates the assessment and rates the cells for its own column; the other providers propose ratings for theirs and internal audit challenges them against the criteria, which is where the map earns its reputation for honesty or loses it. Two rules keep the cells truthful. A provider’s rating is capped by the evidence it can show; “we review that” without a method or results is Limited. And where internal audit intends to rely on a provider’s Substantial cell in its plan, it performs the Standard 9.5 assessment (competence, objectivity, quality of work, usually by reviewing a sample of the provider’s workpapers) and records it, so that the cell carries the reliance decision rather than implying it. A first map for twenty rows and six providers takes four to six weeks, mostly in the interviews; the KPI guide suggests tracking the hours as the cost of coordination that the map’s duplication savings should exceed.
Step 5: find the gaps and overlaps
Gaps are rows rated Partial or Gap in the combined column, and the serious ones are rows that are both high-rated in the risk assessment and thinly assured, which is the intersection the board most needs to see; the annual risk assessment‘s rating sits beside the combined assurance rating for exactly this comparison. Overlaps are rows with two or more Substantial independent cells, which may be deliberate (a regulated process assured by compliance, internal audit and the regulator) or wasteful (three functions testing the same reconciliation, as the Lakeshore case recounts). Each gap and overlap gets a decision: for a gap, which provider will extend coverage, by when, or whether the board accepts it; for an overlap, which provider withdraws or whether the duplication is kept for a reason, and who relies on whom. The decisions are the map’s output, and a map presented without them is a picture rather than a plan.
Step 6: present the board view and govern the map
The board sees one page: the rows, the provider columns with their ratings, the risk rating, the combined assurance rating and a decision column, followed by a short list of the gaps and overlaps with their decisions. The full map with evidence references sits behind it. Governance is simple and essential: the chief audit executive owns the map (it is the function’s coordination tool under 9.5, and the function is the only provider with a view of all the others); it is refreshed annually with the risk assessment and the plan, and updated when a provider’s scope changes; the audit committee receives it with the plan, as the annual agenda‘s fourth-quarter items, and asks about the gaps; and the second-line heads sign their columns, so that the map is a joint statement rather than internal audit’s opinion of its colleagues. The presentation template carries the one-page format.
Variants of the map, and running the workshop
The category map is the base version; four variants serve particular readers. A key-risk map takes the top ten to fifteen register risks as rows and asks the same question of each, which is what a board risk committee wants when it has just approved the appetite statement. A business-unit map puts units or legal entities in the rows and shows where a subsidiary or an acquired company has thin coverage, which is what the Lakeshore examiners asked about for the equipment finance subsidiary. A regulatory map puts obligations or regulatory programs in the rows, which banks maintain for examiners and which the compliance risk assessment feeds. And a combined assurance report, which is the map turned into prose for the board at year end, states for each category what assurance was received from whom, what it concluded and what internal audit relied on, and is the structure the executive summary of the annual report can borrow. All four draw on the same cell data; the first map is the expensive one and the variants are views.
The assessment itself works best as a half-day workshop after the interviews rather than as a circulated spreadsheet. Internal audit pre-populates the cells from the interviews and the evidence, the provider heads attend, and the group walks the rows in risk order, with the facilitator asking each provider to state its coverage against the criteria and show the evidence reference before the rating is agreed; disagreements are recorded in the cell rather than averaged. The workshop produces the gap and overlap list on the day, and the decisions are assigned before anyone leaves, because a decision list circulated afterward acquires owners slowly. Two ground rules keep it civil: the ratings describe coverage, not competence, so a Limited cell is a statement about scope and evidence rather than a judgment of the function; and every provider’s column is its own to sign, so nobody is rated by a colleague without the chance to show the work. The difficult conversations guide has the phrasing for the moment a function discovers its coverage is thinner than it believed.
Template: the cell record
Row: [3.1 Production and food safety]. Risk rating (annual assessment): [High]. Provider: [Quality and food safety function]. Line: [Second]. Scope of coverage: [HACCP plans at all three plants; internal audits of the food safety management system, 15 a year; supplier approval; complaint and incident investigation]. Method: [Documented internal audit program against the certified standard; corrective action tracking]. Independence: [Reports to the CEO; independent of plant management]. Evidence reviewed: [Internal audit schedule and 15 reports for the year; certification body report dated …; customer audit reports from the two major retailers]. Currency: [Within 12 months]. Coverage rating: [Substantial]. Internal audit reliance assessment (9.5): [Competence: certified auditors, training records reviewed. Objectivity: reporting line and no production responsibilities. Work quality: sample of 5 audit files re-performed, findings supported. Conclusion: reliance appropriate for food safety control operation; internal audit retains a biennial review of the function’s program]. Signed: [Quality director, date; CAE, date]. Next review: [Annual, or on loss of certification or change of reporting line].
The completed map: Brightwater Foods
Brightwater Foods is a $180 million food manufacturer with three plants and about 600 staff, used in examples across this site; its first chief audit executive built the function’s universe, risk assessment and plan in the first year (the first 90 days guide) and the assurance map in the second, after the audit committee asked how much of the organization’s assurance it could rely on. The rows are the twenty level-2 categories of the taxonomy the company adopted that year; the providers are first-line management monitoring (Mgmt), the quality and food safety function (Quality, the company’s strongest second-line function, with a certified food safety management system), the finance director’s risk and compliance role (Risk/Comp, a part-time function), the co-sourced IT security provider (IT Sec), internal audit (IA, in-house plus co-source) and external parties (Ext: the external auditor, the food safety certification body, customer audits, insurers). Risk rating is from the annual assessment.
| Risk category (level 2) | Risk rating | Mgmt | Quality | Risk/Comp | IT Sec | IA | Ext | Combined | Decision |
|---|---|---|---|---|---|---|---|---|---|
| 1.2 Market and customer concentration | High | M | L | n/a | Gap | IA advisory review of customer concentration strategy; board accepts residual | |||
| 1.3 Acquisitions and partnerships | Medium | L | L | n/a | L | Gap | IA due diligence review added to plan when next deal arises | ||
| 2.2 Commodity and FX price | Medium | S | M | n/a | L | M (auditor) | Adequate | None | |
| 2.5 Financial reporting and tax | Medium | S | M | n/a | M | S (auditor) | Adequate | IA relies on external audit for statutory accounts; keeps close process audit | |
| 3.1 Production and food safety | High | S | S | n/a | M | S (certification, customer audits) | Adequate | IA relies on Quality after 9.5 assessment; drops planned HACCP audit; keeps a biennial review of Quality itself | |
| 3.2 Workforce and key people | Medium | M | L | n/a | Partial | IA culture and key-person review in year two | |||
| 3.3 Plant and equipment | Medium | S | M | n/a | S (maintenance audit) | M (insurer survey) | Adequate | None | |
| 3.4 Business disruption and resilience | High | M | M | L | M | S (BCM audit) | Adequate | IA validates remediation; resilience program to own ongoing monitoring | |
| 3.5 Fraud | Medium | L | L | M (P2P analytics) | L (auditor) | Partial | Fraud risk assessment and analytics program in plan | ||
| 3.6 Health, safety and environment | High | S | S | n/a | M (regulator inspections) | Adequate | IA relies on Quality’s safety system; no engagement | ||
| 4.1 Cyber and information security | High | L | S | S (cyber resilience review) | Adequate | IA assesses IT Sec provider’s objectivity (vendor assurance over its own work is Limited for reliance); keeps annual engagement | |||
| 4.2 System availability and ERP | High | M | M | S (ITGC audit) | L | Adequate | None | ||
| 4.4 Data integrity | Medium | M | M (traceability) | L | L | Partial | Data governance review in year three | ||
| 5.1 Regulatory compliance (food law, labeling) | High | S | S | M | n/a | L | S (regulator, customers) | Adequate | IA relies on Quality and the compliance risk assessment |
| 5.2 Legal and contractual | Medium | M | M | n/a | Partial | Contract management review in plan | |||
| 5.5 Privacy and data protection | Medium | L | M | L | Partial | IA privacy review in year two | |||
| 6.1 Supplier performance and failure | High | S | M | n/a | S (third-party resilience review) | Adequate | IA validates remediation; procurement to own monitoring | ||
| 6.3 Concentration and fourth parties | High | L | M | Partial | Second-source qualification tracked; IA follow-up | ||||
| 7.1 Governance and oversight | Medium | M | M | n/a | M (charter work) | L (auditor) | Adequate | None | |
| 8.1 Physical climate and water | Medium | L | L | n/a | L (insurer) | Gap | Board accepts; revisit with resilience program’s scenario work |
The decisions the map produced
| Type | Decision | Effect |
|---|---|---|
| Reliance | Internal audit relies on Quality for food safety and health and safety after assessing its competence, objectivity (reports to the CEO, independent of plant management) and work quality (sample of 15 internal audits and the certification body’s report) | Planned HACCP and safety audits (about 300 hours) dropped; a biennial review of Quality’s own program kept |
| Reliance declined | The IT security provider’s assurance over the controls it operates rated Limited for reliance; its coverage counts as first-line monitoring | Annual cyber engagement kept, with the co-source quant |
| Gap closed by internal audit | Customer concentration advisory review; contract management review; privacy review; culture and key-person review | Four engagements added over two years |
| Gap closed by management | Fraud risk assessment owned by the finance director with internal audit’s analytics; second-source supplier qualification | Two first-line programs started |
| Gap accepted | Physical climate and water risk; acquisitions until a deal arises | Board acceptance recorded; revisit triggers set |
| Overlap kept | Regulatory compliance assured by Quality, the compliance risk assessment, the regulator and customers | Deliberate redundancy on the highest-consequence risk |
| Overlap removed | Internal audit’s planned plant-level food safety fieldwork, duplicating Quality and customer audits | Hours redirected to the gaps |
| Governance | CAE owns the map; Quality and the finance director sign their columns; annual refresh with the plan; audit committee receives it | The committee’s first view of combined assurance |
The committee’s reaction to the one-page view was to the three Gap rows and the concentration of Partial rows in the categories nobody owned (people, data, legal, privacy), and its first question was whether a function of two could close them; the map’s answer, that reliance on Quality had just freed 300 hours, was the argument the chief audit executive had built it to make.
Scaling the method: Lakeshore Bancorp’s 126 entities
Lakeshore Bancorp, the $9 billion regional bank used in examples across this site, built its map at the level of its audit universe, 126 auditable entities, against four assurance functions (SOX program office, compliance testing, credit review and model validation as second-line columns, internal audit as the third) plus the external auditor and the regulators, with testing dates in each cell rather than ratings alone. The granularity served internal audit’s planning: the four functions guide recounts how it found three overlaps (suspense reconciliations, wire callbacks, vendor onboarding tested by two or three functions) and two white spaces (incentive compensation, data governance), and how internal audit redirected about 900 hours by relying on SOX and compliance testing it had assessed as reliable. For the board, the 126 rows were rolled up to the twelve level-1 and level-2 categories the bank’s taxonomy uses for its risk report, with the combined rating for each category derived from its entities, so that the board saw one page and the functions worked from the full sheet. The lesson of the two examples is that the method does not change with size; the number of rows and the depth of the cells do, and a function should build the map at the granularity it plans at and roll up for the board rather than build a board-level map it cannot plan from.
How the map supports internal audit’s reliance and plan
| Use | How the map serves it | Standard |
|---|---|---|
| Reliance decisions | Each Substantial second-line or external cell internal audit intends to rely on carries the documented assessment of competence, objectivity and work quality | 9.5 |
| Plan coverage | Gap and Partial rows with High risk ratings become plan priorities; Adequate rows with reliable others’ coverage are scoped around | 9.4 |
| Annual opinion | The combined column is the structure of the function’s overall assessment to the board, stating what it relied on | 15.1; the Domain III conditions |
| Resource case | Gaps the function should close, with hours, beside hours freed by reliance | 8.2 |
| Coordination | The shared testing calendar and request coordination follow from the overlap decisions | 9.5 |
| Quality | External assessors test 9.5 conformance against the map and the reliance assessments | 8.4, 12.1 |
One caution the Standards and experience both give: reliance is on work the function has assessed, not on the existence of a function. A compliance department of forty whose testing the chief audit executive has never read is not a Substantial cell for reliance purposes, whatever its coverage, and the internal audit versus compliance guide explains why.
Failures that make maps decorative
| Failure | How it shows | Fix |
|---|---|---|
| Self-rated cells | Every function Substantial everywhere | Written criteria; evidence references; internal audit challenge; signed columns |
| Activity counted as assurance | Performing a control counted as assuring it | Independence criterion; first-line monitoring only where structured and evidenced |
| Certificates as assurance | A certificate rated Substantial without the assessor’s scope or findings | Rate on the report, not the certificate |
| Rows nobody can answer | “Strategic risk” with blank cells | Rows at the level providers work at |
| No decisions | A colored grid with no actions | A decision per gap and overlap, owned and dated |
| No link to the plan | Map built, plan unchanged | Gaps become engagements; reliance frees hours; both shown |
| Never refreshed | Map dated two years before the reorganization | Annual refresh with the plan; update on provider scope changes |
| Board sees the full sheet | 126 rows in the pack | Roll up for the board; full sheet behind |
Questions about assurance mapping
What is an assurance map?
A table showing, for each significant risk or risk category, which providers across the first, second and third lines and outside the organization give assurance over it and how strong that coverage is, so that gaps, overlaps and reliance can be seen and decided.
Who should own the assurance map?
The chief audit executive, because the map is internal audit’s coordination and reliance tool under Standard 9.5 and the function is the only provider with a view of all the others; the second-line heads sign their own columns so the map is a joint statement.
Should the rows be risk categories or specific risks?
Start with the taxonomy’s level-2 categories (20 to 40 rows), which are stable and read well for a board; add a view for the top register risks once the first works. Functions with a mature universe may map at entity level for planning and roll up for the board.
How do you rate coverage without every function rating itself Substantial?
Written criteria (scope, method, independence, evidence, currency), an evidence reference in every cell, internal audit’s challenge of the second-line ratings, and the rule that a provider’s rating is capped by what it can show.
Does a Substantial rating mean internal audit can rely on that provider?
Only after internal audit has assessed the provider’s competence, objectivity and work quality and documented it, as Standard 9.5 requires. The map records that assessment in the cell; coverage alone is not reliance.
How often should the map be updated?
Annually with the risk assessment and the plan, and whenever a provider’s scope changes (a new compliance testing program, a certification lost, a function restructured). The board receives it with the plan.
What does the board do with it?
Looks at the gaps against the risk ratings, asks what will close them and by when or accepts them explicitly, questions overlaps that waste effort, and uses the combined column as the structure of the assurance it receives over the year.
Related guides
- Internal audit vs SOX vs compliance vs ERM — the providers and their overlaps.
- The Three Lines Model explained — the provider structure.
- Risk taxonomy — the rows.
- The risk register — the alternative rows.
- The annual internal audit risk assessment — the risk rating beside the assurance rating.
- How to build the internal audit plan — where gaps become engagements.
- The bank internal audit universe — Lakeshore’s 126 rows.
- Internal audit vs compliance — why coverage is not reliance.
- SOC 2 report review — rating certificates on their reports.
- Preparing for an external quality assessment — what assessors ask under 9.5.
- GIAS Domain III — the board’s conditions the opinion serves.
- The CAE’s first 90 days — Brightwater’s first year, before the map.
- Auditing cyber resilience and third-party resilience — the engagements behind two Substantial cells.
- How to audit the business continuity program — the BCM cell.
- The audit committee annual agenda — where the map is received.
- Audit committee presentation template — the one-page format.
- Internal audit KPIs — measuring the duplication removed.
- Engagement-level risk assessment — accepting risks the map shows covered elsewhere.
Leave a Reply