Combined assurance is a coordinated approach that aligns management control, risk management and audit activity to give a governing body one clear view of risk.
For an audit committee, it closes the blind spots and ends the duplication that fragmented assurance leaves behind.
Combined assurance and the risk-oversight challenge
Boards, audit committees and accounting authorities receive assurance and reporting from several internal and external channels. Without deliberate coordination those activities drift into silos, producing two governance failures at once — critical strategic and operational risks go unexamined because no one body owns reviewing them, while routine, low-risk controls attract redundant, overlapping reviews that waste scarce administrative capacity. Combined assurance answers this by aligning every assurance activity against the organisation's key risks, so that each significant risk is evaluated once, well and objectively, and the audit committee gains a single, coherent, actionable view of institutional risk.
The assurance providers the law already establishes
A combined-assurance framework draws on providers that South African governance law already puts in place. Operational management is the first line — it owns the daily internal controls, runs the financial-management systems and carries out risk mitigation; under the PFMA, as administered by National Treasury, accounting officers and authorities carry the legal duty to operate those basic financial-management systems and internal controls, and in the corporate sphere the Companies Act 71 of 2008 sets the directors' and board's duty to manage the company's affairs and keep proper financial records. The second provider is the independent internal audit activity: the National Treasury Internal Audit Framework and the PFMA require an adequately resourced internal audit function that periodically assesses risk and evaluates the adequacy and effectiveness of internal control, risk management and governance.
The third is the external auditor — in the public sector the Auditor-General South Africa (AGSA), the supreme audit institution under the Public Audit Act, which gives an independent opinion on whether the financial statements are free from material misstatement, the performance report is useful and reliable, and key legislation has been complied with. Overseeing and coordinating them all is the audit committee, mandated under both the Companies Act 71 of 2008 and the PFMA to evaluate internal control, review risk coverage and promote accountability.
Coordination in practice under the Treasury Regulations
Coordination is operationalised through specific mechanisms in the Treasury Regulations and the National Treasury Internal Audit Framework. The institution must conduct regular risk assessments to identify emerging operational, financial and strategic exposures, and management must maintain a risk-management strategy — including a fraud-prevention plan — that directs internal audit effort and priorities. The internal audit function then builds a risk-based three-year strategic plan and an annual operational plan, concentrating its resources on the high-risk areas.
Under Treasury Regulation 27.1, the audit committee reviews the effectiveness of internal control and of internal audit, the risk areas to be covered in the scope of both internal and external audits, and internal audit's coordination with the external auditors — meeting with the AGSA or external auditor to align scopes, share risk insight and remove unnecessary duplication of testing.
Overseeing and coordinating them all is the audit committee, mandated under both the Companies Act 71 of 2008 and the PFMA to evaluate internal control, review risk coverage and promote accountability.
— Synthesis of South African regulatory guidance
Connecting assurance coverage to clean audit outcomes
A well-built combined-assurance framework links risk oversight directly to the clean audit the institution is working toward. In the AGSA's terms, a clean audit means financial statements free from material misstatement, a useful and reliable performance report, and full compliance with key legislation. By mapping each significant risk to a designated assurance provider, the audit committee ensures that the controls over financial management, reconciliations and legislative compliance are tested through the year rather than discovered at year-end.
When internal audit tests controls against the risk-management strategy, it surfaces deficiencies and compliance breaches early, so that management can act before the external audit begins. Resolving root causes early prevents recurring findings, curbs unauthorised, irregular, and fruitless and wasteful expenditure, and heads off material irregularities — turning assurance from a compliance ritual into a driver of reliability.
Governance habits that make it work
Sustaining combined assurance takes disciplined habits. Roles must be clear, with an explicit line between where operational ownership ends and independent testing begins. The audit committee must be genuinely empowered — working to a formal written charter, with direct access to leadership and real authority over internal audit's plans and resources, as the Treasury Regulations and the Companies Act 71 of 2008 contemplate. And accountability for remediation must bite: when internal audit or the AGSA identifies a weakness, management should produce an action plan with defined milestones and owners, and the audit committee should track it to completion, so that root causes — a policy gap, a missing supervisory review, a training shortfall — are resolved for good.
What good looks like
Good is a governance structure where combined assurance gives the board total clarity over institutional risk. The board under the Companies Act 71 of 2008, or the accounting authority under the PFMA, keeps active oversight of an integrated risk-management architecture; management enforces daily controls; and an adequately resourced internal audit activity runs objective, risk-based evaluations aligned with the Treasury Regulations. The audit committee coordinates internal audit's work plans with the AGSA's external audit scope for full coverage without duplication, strategic risk assessments shape audit priorities, and every deficiency is closed through a monitored action plan — delivering sound financial management, credible reporting and sustained clean audit outcomes.
Related insights
- Internal audit and the audit committee: building assurance leaders can rely on
- Risk appetite: translating board intent into management decisions
- Internal audit co-sourcing and outsourcing: a decision guide for audit committees
Sources
- Internal Audit Framework (Revised 2009) — National Treasury (Office of the Accountant-General)
- What we do: internal audit, audit committees and clean audits — Auditor-General South Africa
- Public Finance Management Act: legislation overview — National Treasury
- Companies Act 71 of 2008 — South African Government
Frequently Asked Questions
What is combined assurance?
Combined assurance is a coordinated approach that aligns management control, risk management, and audit activity to give a governing body one clear view of risk. For an audit committee, it closes the blind spots and ends the duplication that fragmented assurance leaves behind, ensuring each significant risk is evaluated once, well, and objectively.
Who does combined assurance apply to in South Africa, and what legal frameworks underpin it?
Combined assurance applies to boards, audit committees, and accounting authorities in both the public and corporate spheres. It draws on existing legal duties under the PFMA, as administered by National Treasury, and the Companies Act 71 of 2008, which mandate financial management systems, internal controls, and audit committee oversight.
What problem does combined assurance address for South African entities?
Combined assurance addresses the problem of fragmented assurance, where uncoordinated activities lead to critical strategic and operational risks going unexamined, while routine controls attract redundant reviews. This results in governance failures, wasting scarce administrative capacity and obscuring the true institutional risk picture.
What does compliance with combined assurance look like in practice, and what are the consequences of failure?
In practice, compliance involves regular risk assessments, a risk-management strategy, and a risk-based internal audit plan, with the audit committee coordinating internal and external audit scopes under Treasury Regulation 27.1. Failure to implement combined assurance can lead to recurring findings, unauthorised expenditure, material irregularities, and a lack of a clean audit outcome.
Where do most organisations encounter challenges in implementing combined assurance?
Organisations often struggle when roles are unclear, blurring the line between operational ownership and independent testing. Challenges also arise if the audit committee is not genuinely empowered with real authority over internal audit's plans and resources, or if accountability for remediation of identified weaknesses does not effectively bite.