Assurance Map: What It Is and How to Build One (With Example)

Maxim Atanassov • August 25, 2024

An assurance map is a table that shows, for each key risk, who provides assurance that the risk is under control, how much assurance they provide, and where coverage is missing or duplicated. Rows are risks. Columns are the providers of assurance: management, the risk and compliance functions, internal audit and external parties. Each cell records the work done and the confidence it gives. The board reads it to answer one question: are we sure our most important risks are managed, and how do we know?

Assurance map vs. risk register vs. heat map

The three tools are often confused. Each answers a different question.

Tool	Question it answers	Rows	Columns
Risk register	What could go wrong?	Risks	Cause, impact, likelihood, owner, controls
Risk heat map	How big is each risk?	Impact	Likelihood
Assurance map	How do we know each risk is controlled?	Risks	Assurance providers

An assurance map starts where the risk register ends. It takes the top risks from the register and tests the confidence the organization can place in their controls.

Why build one

It finds gaps. A critical risk with no independent assurance is a blind spot. Boards most often find these in cyber security, third-party risk and culture.
It finds duplication. When internal audit, compliance and an external certifier all test the same access controls in the same year, the map shows it, and one test can serve all three.
It lets assurance providers rely on each other. The Institute of Internal Auditors' Global Internal Audit Standards (2024) require the chief audit executive to coordinate with other assurance providers and consider relying on their work (Standard 9.5). The assurance map is the usual way to do it.
It gives the audit committee one view. Instead of separate reports from audit, risk, compliance and safety, the committee sees all assurance over each risk on one page.

The Three Lines Model: the columns of the map

Most assurance maps organize their columns around the IIA's Three Lines Model (2020):

First line: management. The people who own and run the process own the risk. Their assurance comes from supervision, reconciliations, key performance indicators and self-assessments.
Second line: risk, compliance and other specialist functions. They set policy, monitor and challenge the first line. Examples: enterprise risk management, compliance, information security, health and safety, quality.
Third line: internal audit. It provides independent, objective assurance to the board.
External assurance: external auditors, regulators, certification bodies (ISO 27001, SOC 2) and insurers' reviews. ACCA and some regulators call this the fourth line.

Independence rises from the first line to the third. So does the confidence a board can place in the work.

How to build an assurance map in seven steps

1. Choose the risks

Start with the 10 to 15 principal risks from the enterprise risk register, the ones the board already reviews. A map with 80 rows is a register, not a map.

2. List every assurance provider

Name each team that tests, monitors or reviews anything: process owners, finance, risk, compliance, information security, legal, health and safety, internal audit, the external auditor, regulators and certifiers.

3. Record the assurance each provider gives over each risk

For each cell, write what the provider does (a control test, a review, a certification), how often, and when it last reported. Interview the providers; do not rely on their charters.

4. Rate each cell

Use a simple scale and define it in writing:

Substantial: recent, independent testing found the controls effective.
Moderate: testing is partial, dated or done by the first line only.
Limited: testing found weaknesses, or the work is monitoring rather than testing.
None: no provider covers the risk.

5. Form an overall view for each risk

Combine the cells into one rating per risk, weighting independent work more heavily. Then compare it with the risk's severity. A severe risk needs substantial assurance; a minor one can live with moderate.

6. Mark the gaps and overlaps

A gap is a severe risk with less assurance than it needs. An overlap is two or more providers testing the same controls without relying on each other.

7. Agree on actions and report

Assign each gap an owner and a date. Feed the gaps into next year's internal audit plan. Present the map to the audit committee once a year, and update it when a principal risk changes.

A worked example

A mid-sized company maps four of its principal risks.

Principal risk	Severity	First line: management	Second line: risk, compliance, IT security	Third line: internal audit	External	Overall assurance	Action
Cyber breach	High	Moderate: monthly patch and access reports	Moderate: quarterly vulnerability scans	None: last audit in 2023	Substantial: SOC 2 Type II, 2026	Moderate	Gap. Internal audit to review incident response in Q1
Revenue recognition error	High	Substantial: monthly reconciliations	Moderate: controllership review	Substantial: ICFR testing, 2026	Substantial: external audit	Substantial	Overlap. External auditor to rely on internal audit's ICFR testing
Key supplier failure	High	Limited: no supplier monitoring	None	None	None	None	Gap. Procurement to build a supplier risk process; audit in Q3
Health and safety incident	Medium	Substantial: site inspections	Substantial: safety audits	Moderate: 2024 audit	Moderate: regulator inspection	Substantial	None

Read across a row and the story is plain. Revenue recognition is tested three times; key supplier failure, a high risk, is tested by no one.

Common mistakes

Mapping too many risks. The map loses the board. Keep it to the principal risks.
Counting activity as assurance. A policy is not assurance; a test of whether people follow it is.
Trusting old work. Assurance decays. Discount any review older than its risk's cycle, usually 12 to 36 months.
Building it in a spreadsheet nobody owns. Give the map an owner, usually the chief audit executive or the chief risk officer, and a date to refresh it.
Rating without definitions. Two providers will read "moderate" two ways. Write the scale down.

Frequently asked questions

What is assurance mapping in internal audit?

Assurance mapping is the process of recording which providers give assurance over each key risk, so internal audit can coordinate with them, rely on their work and aim its own plan at the gaps.

What are the three levels of assurance?

In audit engagements, auditors give reasonable assurance (an audit), limited assurance (a review) or no assurance (a compilation or agreed-upon procedures). Assurance maps use their own scale, such as substantial, moderate, limited and none.

Who owns the assurance map?

Usually the chief audit executive, sometimes jointly with the chief risk officer. The audit committee reviews it.

How often should an assurance map be updated?

Rebuild it once a year, before the internal audit plan is set. Update it whenever a principal risk is added or its rating changes.

Is an assurance map the same as a combined assurance model?

They are related. Combined assurance is the practice of coordinating all assurance providers, a term the King IV Code in South Africa made common. The assurance map is the tool that makes combined assurance visible.