A combined assurance model is a framework aligning internal controls and independent reviews. It gives boards a unified view of institutional risk.
Understanding combined assurance and provider roles
Establishing a combined assurance model requires coordinating internal and external assurance providers to evaluate organisational risk systematically. Governing bodies and audit committees require clear visibility over institutional risk without suffering from assurance gaps or duplicate audit procedures.
The operation of internal control systems is the responsibility of the relevant line managers.
— National Treasury Internal Audit Framework2009, section1.3.2.5, page8
Domain IV of the Global Internal Audit Standards, issued in January 2024 and effective from January 2025, sets explicit expectations for managing coordination under Standard 9.5. In contrast, the National Treasury Internal Audit Framework Revised 2009 offers historical public sector context regarding audit committee oversight and external audit alignment.
Combining assurance activities involves mapping various risk coverage sources across the institution:
- Line management operating routine internal controls and risk management workflows.
- Specialist internal functions providing compliance, safety, IT security, and risk oversight.
- The internal audit function delivering independent, objective assurance on governance and controls.
- External assurance bodies, including public sector supreme audit institutions and statutory auditors.
Understanding these distinct roles ensures that each provider contributes to overall organisational assurance within its defined mandate. Effective coordination can reduce avoidable duplicated work; overlapping coverage may still be justified by distinct mandates, time periods or evidence needs.
Distinguishing management responsibility from internal audit independence
An effective combined assurance model coordinates assurance activities without merging management responsibilities with internal audit functions. Executive management maintains primary ownership of internal control systems, policy implementation, and operational risk mitigation.
Internal audit remains an independent, objective assurance activity reporting functionally to the board or audit committee. Coordinating work programs with management or other providers does not diminish internal audit's organisational independence.
The chief audit executive must maintain clear functional boundaries, ensuring internal auditors do not assume operational duties or management decision-making. Distinguishing coordination from operational execution protects the objectivity required for credible reporting.
Operational management remains accountable for designing and executing internal controls regardless of external assurance reviews. Internal audit provides objective evaluation rather than managing operational workflows.
Designing the implementation workflow and assurance map
Developing a practical combined assurance workflow starts with establishing an institutional assurance map. An assurance map links significant risk categories identified in the organisational risk register with specific internal and external assurance sources.
The chief audit executive collaborates with senior management and other providers to identify risk coverage and highlight potential overlaps or unmitigated exposures. The institution should identify the applicable legal mandate and governance arrangements before assigning oversight responsibilities.
This structured mapping process enables the audit committee to evaluate whether existing assurance coverage is sufficient across all operational domains. The workflow establishes regular information-sharing channels without imposing arbitrary or universal review frequencies.
Assurance mapping should be updated periodically to reflect changes in organisational strategy, risk profile, and operating structures. Regular review ensures that assurance coverage remains aligned with evolving risk priorities.
Evaluating justified reliance and provider objectivity
A core principle of combined assurance is determining when the internal audit function can justify relying on the work of other assurance providers. Standard 9.5 mandates that when internal audit relies on external or internal providers, the chief audit executive must document the basis for reliance while retaining full responsibility for internal audit conclusions.
Automatic reliance without independent evaluation is prohibited under professional standards. The implementation considerations accompanying Standard 9.5 describe a useful evaluation of provider roles, independence, competence, objectivity and due professional care:
- The provider's organisational independence and freedom from operational conflicts of interest.
- The professional competence, qualifications, and experience of the assurance team.
- The due professional care applied in planning, testing, and documenting work programs.
- The relevance, reliability, and sufficiency of evidence supporting reported conclusions.
Where the evidence does not justify reliance, document the limitation, consider alternative assurance or additional work and explain any remaining coverage gap to the relevant oversight body.
Documenting the evaluation methodology provides defensible evidence of due professional care during internal and external quality assessments. Retaining full responsibility reinforces professional accountability.
Structuring the four-column workstream matrix
To operationalise combined assurance effectively, institutions deploy a structured workstream matrix that defines roles, activities, and reliance boundaries. The four-column matrix below outlines the practical coordination workflow across management, internal audit, and external providers.
| Workstream phase | Management responsibility | Internal audit role | Reliance & evidence basis |
|---|---|---|---|
| Risk identification | Identify operational risks and maintain control frameworks | Independently validate key risks and audit universe | Documented risk registers and validated control matrices |
| Assurance mapping | Map daily controls and operational oversight mechanisms | Coordinate assurance coverage across all providers | Assurance map discussed with the responsible oversight body under its actual mandate |
| Workplan alignment | Execute daily controls and report operational metrics | Synchronise audit timing and share work scope | Joint coordination meetings and shared audit schedules |
| Reliance evaluation | Provide access to operational records and reports | Evaluate provider competence and document reliance basis | Formally documented assessment of provider objectivity |
Implementing this four-column matrix provides a transparent governance roadmap that clarifies operational duties while strengthening oversight. Regular review of workstream deliverables keeps assurance alignment responsive to changing risk landscapes.
Sources
- National Treasury Internal Audit Framework, second edition March2009 — National Treasury
- IIA Global Internal Audit Standards2024, effective9January2025 — Institute of Internal Auditors
Frequently Asked Questions
How does Standard 9.5 define the chief audit executive's responsibility when relying on another provider?
Standard 9.5 specifies that while the chief audit executive may rely on other assurance providers to minimise duplication, internal audit retains full responsibility for its own conclusions. The chief audit executive must formally document the rationale and evidence supporting any reliance.
What is the distinction between assurance coordination and automatic reliance?
Coordination involves sharing risk information, synchronizing schedules, and mapping coverage to avoid gaps. Automatic reliance assumes another provider's findings are correct without evaluation, whereas justified reliance requires the chief audit executive to assess the provider's independence, competence, and due professional care.
How do historical Treasury 2009 guidelines compare with the 2024 Global Internal Audit Standards regarding combined assurance?
The 2009 Treasury Framework provides historical local public sector context on audit committee oversight and auditor coordination under the PFMA. The 2024 Global Internal Audit Standards, effective January 2025, establish updated global mandatory requirements for chief audit executives managing coordination and reliance.
Does implementing a combined assurance model alter management's operational accountability for internal controls?
No, implementing combined assurance does not shift operational accountability. Line management retains primary ownership for operating internal controls and managing risk, while internal audit provides objective assurance on control effectiveness to the board.
What steps should the chief audit executive take if an external assurance provider lacks sufficient independence or evidence?
Document why reliance is unsupported and decide what additional work or alternative evidence is proportionate. Escalate any unresolved coverage limitation; do not describe the area as independently assured simply because another provider reviewed it.
For wider context, read the combined assurance overview.