An assurance map is a dated matrix linking institutional risks, controls and provider coverage to evidence, gaps and potential duplication.
It helps an audit committee ask what has been reviewed, for which period and with what limitations. A gap in independent coverage does not automatically mean a control is absent or ineffective. Likewise, two reviews of the same area may serve different mandates.
Structuring the assurance map artefact around institutional risks and controls
The operation of internal control systems is the responsibility of the relevant line managers.
— National Treasury Internal Audit Framework2009, section1.3.2.5, page8
An assurance map functions as an analytical artefact designed to provide audit committees with a transparent overview of risk coverage. Developing this artefact requires linking significant risk categories identified in the organisational risk assessment with specific management controls and assurance activities.
Management controls serve as primary operational mitigations, whereas assurance activities provide independent or secondary evaluations of control adequacy.
To be practically useful, the assurance-map artefact must capture detailed operational dimensions across the risk landscape. These dimensions include risk descriptions, key management controls, provider coverage, audit scope, engagement timing, supporting evidence, and reliance parameters. Capturing these elements enables leadership to evaluate whether assurance resources are deployed effectively across high-risk operational domains.
It is essential to recognise that mapping assurance coverage does not in itself prove control effectiveness. An assurance map displays where oversight is planned or executed, but evaluating whether controls operate effectively requires direct, objective testing of evidence.
Treating a coverage map as proof of control effectiveness creates a false sense of security regarding organisational resilience.
Preserving provider independence while identifying coverage gaps and overlaps
A primary objective of assurance mapping is identifying coverage gaps where significant risks lack adequate review, as well as overlaps where multiple providers test identical controls. Addressing these imbalances enables chief audit executives and audit committees to optimise assurance coverage, eliminate wasteful duplicate audits, and focus resources on unmitigated exposures.
While assurance mapping encourages coordination, it must preserve the distinct, independent roles of various assurance providers. Operational management maintains primary accountability for managing risk and executing internal controls.
Internal risk and compliance functions deliver secondary operational oversight, whereas the internal audit activity provides independent, objective assurance to the board. External auditors work under their specific mandates; the coverage and form of compliance reporting should be established rather than assumed.
Coordinating work programs across these distinct providers does not erode internal audit's organisational independence or shift operational duties onto auditors. Furthermore, an assurance-map artefact must be distinguished from broader model implementation or partner commissioning, functioning specifically as a diagnostic decision-support tool for governing bodies.
Evaluating evidence quality and criteria for justified reliance
When constructing an assurance map, the chief audit executive must evaluate whether internal audit can justify relying on the work of other internal or external assurance providers. Under Standard 9.5, the chief audit executive must document the basis for reliance and retain responsibility for internal audit conclusions. The implementation considerations guide evaluation of provider roles, independence, competence, objectivity and due professional care.
Automatic reliance without independent evaluation is strictly prohibited under professional standards. Internal audit retains ultimate responsibility for its conclusions even when incorporating assurance provided by third parties.
To maintain an effective assurance map over time, chief audit executives should embed several core practical routines:
- Regularly updating the audit universe to reflect emerging strategic risks, operational changes, and system updates.
- Gathering engagement scopes, audit programs, and testing schedules from internal compliance units and external review bodies.
- Assessing the relevance, reliability, and sufficiency of supporting audit evidence before documenting reliance on external findings.
- Presenting annotated gap and overlap analyses to the audit committee to inform strategic audit plan adjustments.
Navigating dates, scope boundaries, and inherent map limitations
Assurance maps represent static snapshots bounded by specific timeframes, operational scopes, and testing methodologies. Audit committees must acknowledge these inherent boundaries when reviewing mapped data. A risk area marked as covered during a prior period may become exposed if operational controls, key personnel, or underlying IT systems change.
Furthermore, assurance providers operate under defined scope limitations that restrict the depth of their evaluations. For example, a high-level compliance review may inspect policy documentation without re-testing transaction processing effectiveness. Assurance maps must explicitly record the dates, scope boundaries, and limitations of each provider's work to prevent misinterpretation.
Acknowledging these operational boundaries ensures that governing bodies treat the assurance map as an evolving diagnostic tool rather than a static guarantee of operational integrity.
Annotated four-column assurance map matrix
The four-column matrix below illustrates a practical assurance-map artefact, mapping qualitative hypothetical risk scenarios against management controls, provider coverage, and reliance assessments.
| Risk Category & Management Control | Assurance Provider & Scope | Timing & Evidence Reviewed | Annotated Gap, Overlap & Reliance Assessment |
|---|---|---|---|
| Supply chain procurement compliance; dual-authorisation control on purchase orders above established thresholds. | Internal Compliance Unit; operational review of supply chain policy adherence across regional offices. | Annual review; reviewed a risk-selected set of procurement files and policy exception logs. | Identified overlap with internal audit; compliance testing provides secondary assurance but lacks technical system testing. Consider reliance only for the supported policy-adherence scope, subject to a documented evaluation. |
| Cyber security access control; multi-factor authentication and quarterly user access rights recertification. | IT Risk Committee & External Cybersecurity Consultant; penetration testing and access right reviews. | Bi-annual review; system access logs, user privilege lists, and vulnerability reports. | Coverage gap identified regarding privileged user activity monitoring. Competence alone does not justify reliance; assess scope, objectivity and evidence, then decide whether additional work is needed. |
| Financial statement reporting; monthly general ledger reconciliations and supervisory journal approvals. | External Auditor & Internal Audit Activity; statutory audit of financial statements and key financial controls. | Quarterly and annual reviews; bank reconciliations, ledger balances, and sample transaction testing. | Potential duplication of key control testing. Internal audit coordinated testing schedules with external audit under Standard 9.5 to reduce redundant sampling while maintaining scope. |
| Vendor contract management; performance monitoring against service level agreements and contract terms. | Line Management; routine departmental review of supplier deliverables and invoice sign-offs. | Monthly operational checks; vendor invoices and performance sign-off sheets. | Critical assurance gap identified; no independent assurance provider reviews contract management. Consider a targeted contract review against competing priorities and obtain any required plan approval. |
Sources
- National Treasury Internal Audit Framework, second edition March2009 — National Treasury
- IIA Global Internal Audit Standards2024, effective9January2025 — Institute of Internal Auditors
Frequently Asked Questions
Does an assurance map prove that internal controls are operating effectively?
No, an assurance map demonstrates where assurance coverage is planned or executed across risk categories, but it does not prove control effectiveness. Evaluating whether internal controls operate effectively requires independent, objective testing of evidence by auditors.
How does Standard 9.5 frame the chief audit executive's responsibility when using an assurance map?
Standard 9.5 requires the chief audit executive to coordinate assurance services and consider relying on other providers to minimise duplication and highlight risk gaps. When relying on other providers, the chief audit executive must document the basis for reliance while retaining full responsibility for internal audit conclusions.
What is the difference between an assurance gap and an internal control deficiency?
An assurance gap occurs when a significant risk category or management control lacks independent or secondary evaluation by an assurance provider. An internal control deficiency refers to a flaw in control design or execution that fails to mitigate risk effectively.
How do historical 2009 National Treasury guidelines view assurance coordination compared with the 2024 Global Internal Audit Standards?
The 2009 National Treasury Framework provides historical public sector context regarding audit committee oversight and coordination between internal and external auditors under the PFMA. The 2024 Global Internal Audit Standards, effective January 2025, establish updated global mandatory requirements under Standard 9.5 for managing coordination and reliance.
Can internal audit rely automatically on compliance or risk management testing listed on an assurance map?
No, automatic reliance is prohibited under Standard 9.5. The chief audit executive must evaluate the provider's organisational independence, professional competence, due professional care, and testing methodology before documenting a justified basis for reliance.
For wider context, read the combined assurance overview.