Independent support for risk-maturity assessment is a commissioned review with agreed criteria, evidence requirements and safeguards for impartial judgement.
The appointment should define the assessment decision, proposed methodology, team capability, access and usable deliverables. Evaluate the actual proposed team and any conflicts, then set acceptance and handover arrangements that preserve independent conclusions.
Establishing commissioning scope and evidence-based evaluation methodology
The operation of internal control systems is the responsibility of the relevant line managers.
— National Treasury Internal Audit Framework2009, section1.3.2.5, page8
Commissioning independent support for a risk-maturity assessment begins with establishing a formal terms of reference that defines the engagement scope, objectives, and evaluation methodology. Governing bodies and chief audit executives must specify that prospective service providers deploy an evidence-based assessment methodology rather than relying on uncorroborated management interviews.
The terms of reference must require providers to evaluate the extent to which risk management processes are embedded across operational routines, comparing observed practices against approved governance policies. The methodology should examine risk identification, assessment rigor, control integration, and oversight reporting.
Establishing an evidence-based methodology upfront ensures that proposal evaluations focus on technical rigor rather than marketing claims. The commissioning scope must explicitly state that missing written documentation does not automatically signify a control failure if informal practices effectively mitigate risk, while also clarifying that statutory documentation requirements cannot be excused.
Evaluating prior work conflicts and safeguarding reviewer objectivity
A critical component of proposal evaluation is assessing potential or actual conflicts of interest that could impair the external provider's objectivity. Request relevant current and prior relationships, including advisory, audit, design and operational work, and assess their effect on the proposed team's objectivity.
For internal audit assurance, Standard2.2 presumes impairment when an auditor had responsibility for the activity during the preceding twelve months. Previous advisory work instead requires the chief audit executive to assess its nature and manage individual objectivity; it is not an automatic exclusion for every provider. Selecting a provider with unmanaged self-review threats compromises the credibility of the assessment findings presented to the audit committee.
Agree reporting arrangements that protect impartial judgement and give the commissioning oversight body appropriate access to findings. Establishing robust conflict-screening protocols helps identify threats to impartial judgement and the safeguards needed before appointment.
Assessing team competencies and defining access and confidentiality terms
Proposal evaluation requires verifying that the prospective external team collectively possesses the necessary professional knowledge, skills, and sector experience to execute the assessment. Chief audit executives and audit committees must inspect team credentials, relevant assessment history, and technical competencies rather than relying solely on firm-level reputation.
Commissioning agreements must establish explicit terms governing information access, data protection, and confidentiality. Agree access to relevant personnel and records within the actual mandate, confidentiality and lawful security arrangements. Document unresolved restrictions and their effect on the proposed conclusions.
To ensure proposal evaluation remains thorough and objective, commissioning authorities should implement several key practical evaluation steps:
- Require bidders to submit detailed methodology statements explaining evidence-triangulation techniques.
- Examine conflict-of-interest disclosures covering all proposed team members and past organisational engagements.
- Verify individual team competencies, sector experience, and familiarity with public governance frameworks.
- Establish formal confidentiality agreements and secure data-handling protocols prior to engagement initiation.
- Define a transparent reporting format, with evidence-linked judgements and no invented certification or unsupported precision.
Defining deliverables, calibrated qualitative judgements, and acceptance protocols
Commissioning terms must define explicit, usable deliverables that provide actionable governance insights for leadership. Key deliverables include a qualitative maturity profile, an evidence-gap analysis, and a prioritised remediation roadmap.
Deliverables must present calibrated qualitative judgements that reflect organisational size, operational complexity, and statutory context. This proposed mandate uses descriptive findings linked to evidence. If a numerical model is requested, require an established basis, transparent criteria, interpretation limits and a clear distinction between an assessment score and any independently verified certification.
Domain IV of the Global Internal Audit Standards, issued in January 2024 and effective from January 2025, requires the chief audit executive under Standard 9.1 to understand risk management processes to inform internal audit strategy, without mandating a specific maturity score. In local government, the uThukela District Municipality Enterprise Risk Management Framework 2021-2022 serves as an institution-specific municipal example under the MFMA, rather than a nationwide binding rule.
Formal acceptance protocols require executive management and the chief audit executive to review draft deliverables to verify factual accuracy before final presentation to the audit committee. Acceptance protocols establish that management endorses the factual basis of the assessment without altering independent conclusions.
Defining formal handover and recommended proposal evaluation matrix
Handover protocols ensure a seamless transition of assessment deliverables to internal governance owners upon engagement completion. The appointed provider must deliver technical debriefs and structured action-planning workshops to support internal staff in executing recommended enhancements.
The four-column matrix below outlines a qualitative, non-mandatory proposal evaluation crosswalk, aligning evaluation criteria with due diligence focus, standard landmarks, and illustrative evidence requirements.
| Proposal Evaluation Criteria | Due Diligence & Technical Focus | Standard & Framework Landmark | Illustrative Evidence Requirement |
|---|---|---|---|
| Evidence-Based Methodology | Triangulation of interviews with physical records and operational data | Standard 13.4, Standard 14.1; uThukela ERM Framework Chapter 5 | Detailed proposal workplan outlining document sampling and verification steps |
| Conflict & Objectivity Disclosures | Identification of prior advisory, audit, or control design engagements | Standard 2.2, Standard 9.5; uThukela ERM Framework Chapter 7 | Signed independence declarations covering all proposed team members |
| Team Competencies & Access | Relevant sector experience, technical skills, and secure record protocols | Standard 3.1, Standard 5.2; uThukela ERM Framework Chapter 7 | Verified team CVs, project histories, and data security attestations |
| Qualitative Deliverables & Handover | Descriptive maturity reporting, remediation roadmaps, and debrief workshops | Standard 14.4, Standard 15.1; uThukela ERM Framework Chapter 3 | Sample reporting templates demonstrating evidence-backed qualitative analysis |
Sources
- Uthukela municipal2021/22 framework: institutional example of local-governmentrisk/maturity, NOT nationwide currentlaw or universalassessmentscale — Uthukela
- IIA2024 standards issued2024-01-09 effective2025-01-09 — Institute of Internal Auditors
- National Treasury Internal Audit Framework, second edition2009 — National Treasury
Frequently Asked Questions
How should an audit committee evaluate prior work conflicts when appointing an independent risk-maturity assessor?
Request relevant relationships and prior work, then assess the nature of any self-review threat and proposed safeguards. Apply the precise independence and objectivity rules relevant to the engagement; do not turn the internal-audit rule about prior operational responsibility into a universal ban on previous advisory work.
What distinguishes an evidence-based assessment methodology from a questionnaire-based proposal?
An evidence-based methodology requires assessors to corroborate interview assertions against physical operational records, committee minutes, and control logs, whereas questionnaire-based proposals rely solely on unverified self-assessments.
How should commissioning terms address qualitative profiles and numerical models?
A qualitative profile can explain observed practice, evidence gaps and improvements directly. If a numerical model is used, require transparent criteria, an established basis and interpretation limits. A number is not automatically a recognised certification or evidence that the process operates effectively.
How do current IIA Standards and the 2021-2022 uThukela ERM Framework inform the commissioning scope?
IIA Standard 9.1 requires chief audit executives to understand risk processes to inform audit strategy, while the 2021-2022 uThukela ERM Framework provides a contextual municipal example without imposing a nationwide mandatory maturity grade.
What protocols govern deliverable acceptance and handover upon completion of the independent assessment?
Acceptance protocols require executive management and the chief audit executive to review factual accuracy, followed by formal handover workshops where deliverables are transferred to internal owners for remediation tracking.
For wider context, read the risk maturity overview.