Defining a combined-assurance advisory mandate and reporting cadence

A combined-assurance advisory mandate is an agreed scope defining assurance coordination, deliverables, responsibilities and reporting arrangements.

The commissioning decision should identify the coverage problem to solve and the evidence the institution needs. Coordination can reduce avoidable duplication while preserving the distinct responsibilities of management, internal audit and other providers.

Commissioning objectives, governance scope, and accountable owners

The operation of internal control systems is the responsibility of the relevant line managers.

— National Treasury Internal Audit Framework2009, section1.3.2.5, page8

Commissioning a combined-assurance advisory engagement requires defining scope, operational boundaries, and governance objectives prior to initiating mapping activities. Governing bodies and executive authorities must establish clear terms of reference that specify accountability, operational governance, and required deliverables.

The primary objective of the advisory mandate is establishing an integrated coordination framework without compromising functional independence or shifting management duties. Accountable owners must be designated across governance tiers:

• Executive management holds operational accountability for maintaining internal controls and managing risk exposures.
• The chief audit executive maintains functional responsibility for coordinating assurance activities and evaluating reliance boundaries.
• Second-line compliance, risk, and technical specialists provide operational monitoring within their designated mandates.
• The responsible oversight body reviews assurance coverage and reporting under its actual statutory mandate and charter.

Clarifying accountable owners ensures that advisory activities strengthen institutional governance without creating operational ambiguity. The commissioning scope must explicitly state that operational management retains full responsibility for managing risks and operating internal controls.

Establishing this clarity prevents the misconception that advisory engagements or assurance mapping relieve line managers of their routine control duties. Effective governance requires that operational leadership actively maintains control environments while assurance providers deliver objective evaluations.

Building the assurance inventory and deliverables

Operationalising the advisory mandate requires compiling an assurance inventory that captures all internal and external assurance sources across the organisation. The inventory identifies existing management reviews, specialist oversight, internal audit engagements, and external statutory evaluations.

The commissioning scope should require usable, practical mapping tools rather than theoretical models. Recommended deliverables, subject to the agreed scope, include an assurance coordination protocol, an assurance provider inventory, an integrated risk-coverage map, and a governance reporting schedule.

Domain IV of the Global Internal Audit Standards, issued in January 2024 and effective from January 2025, establishes mandatory requirements under Standard 9.5 for chief audit executives managing assurance coordination. In contrast, the National Treasury Internal Audit Framework Revised 2009 provides dated historical context regarding public sector audit committee responsibilities and external audit alignment.

Differentiating mandatory standard requirements from advisory implementation guidance is essential for sound governance. Under the Global Internal Audit Standards, mandatory practices are designated by the term "must" within standard requirements. In contrast, non-mandatory implementation considerations use "should" or "may" to suggest flexible, advisory practices.

Usable deliverables enable oversight bodies to identify unmitigated risks, identify avoidable duplication, and optimise resource allocation. The proposed inventory should document each provider's scope, methodology, and reporting structure.

Establishing reliance boundaries and evaluating provider objectivity

A critical component of the advisory mandate is defining explicit reliance boundaries to prevent unjustified reliance on external or internal reviews. Standard 9.5 requires a documented basis for reliance; its implementation considerations describe evaluating provider independence, competence, objectivity and due professional care.

Evaluating provider objectivity requires assessing whether the provider operates free from management interference or self-review conflicts. Recommended practices suggest conducting formal due diligence, reviewing provider methodologies, and examining supporting workpapers to confirm evidence reliability.

Standard 9.5 explicitly stipulates that the chief audit executive retains ultimate responsibility for all internal audit conclusions and opinions, regardless of reliance placed on other providers. Reliance cannot be automatic or assumed without documented justification.

If a provider's evidence does not support reliance, the mandate should identify the unresolved gap and options for additional work; unverified findings must not be presented as established assurance. Documenting reliance criteria safeguards professional integrity and supports quality assessments.

Conducting periodic re-evaluations of external and second-line assurance providers ensures that reliance assumptions remain valid throughout the organisational lifecycle. This continuous monitoring protects the internal audit function against blind reliance on flawed external reviews.

Linking reporting cadence to institutional risk and committee calendars

Establishing an effective combined-assurance reporting cadence requires aligning reporting frequencies with institutional risk profiles and existing governance calendars. Reporting schedules must reflect the velocity and severity of organisational risks rather than adhering to rigid, universal calendar rules.

Standard 9.5 does not itself prescribe a universal monthly or quarterly combined-assurance reporting interval. Check the institution's actual legislation, charter, mandates and committee requirements before setting its schedule. High-risk operational domains facing rapid change may require frequent reporting, while other areas may support a different frequency justified by evidence and applicable obligations.

The reporting cadence must integrate seamlessly with existing board and audit committee meeting schedules. Synchronizing reports with committee cycles ensures that oversight bodies receive timely, risk-relevant insights without administrative overload.

Aligning reporting schedules with risk velocity maintains governance responsiveness while respecting administrative capacity. Flexible cadences prevent reporting fatigue and focus committee attention on critical exposures.

Designing custom reporting dashboards for governance committees enhances the visibility of cross-provider assurance insights. These visual tools highlight risk-coverage trends, emerging gaps, and reliance boundaries across operational divisions.

Defining formal handover, acceptance, and governance maintenance

Completing the advisory engagement requires a formal handover protocol to transfer mapping deliverables to internal governance owners. The agreed acceptance process should identify how the chief audit executive and senior management review the final deliverables, ensuring alignment with institutional objectives.

Handover protocols should include executive debriefs, technical workshops, and operational guidance on maintaining the assurance map. The proposed mandate should require documented maintenance procedures so internal staff can update risk inputs periodically.

Governance maintenance requires updating the assurance inventory whenever significant changes occur in organisational strategy, risk profile, or operating structures. Periodic review ensures that the combined-assurance framework remains dynamic and responsive over time.

Formally closing the advisory mandate establishes a clear transition from external advisory support to sustainable internal ownership. Continued maintenance embeds combined assurance into routine organisational oversight.

Agreeing review triggers and an appropriate periodic review of the assurance arrangements helps keep them responsive to changing mandates, risks and operations. Ongoing maintenance reinforces long-term institutional resilience.

For wider context, read the combined assurance overview.