Independent Assurance and Audit of Governance (CGEIT – Benefits Realization)
Introduction
Independent assurance and audit of governance is the objective examination of whether the enterprise governance of information and technology (EGIT) framework is designed properly and working effectively. In the CGEIT context, it sits within the Benefits Realization domain because the board and executive management need confidence that IT-enabled investments deliver the promised value, that risk is kept within appetite, and that resources are used responsibly. Assurance turns management claims ("our governance works") into evidence-based conclusions that stakeholders can rely on.
Why It Is Important
1. Accountability to the board and stakeholders: The board is accountable for governance but cannot personally check every process. Independent assurance gives it an objective view of whether its direction is being followed.
2. Validates benefits realization: Post-implementation reviews and benefits audits confirm whether business cases were accurate and whether expected value was actually achieved. They also expose optimism bias and benefit leakage.
3. Supports the Evaluate-Direct-Monitor (EDM) cycle: In COBIT and ISO/IEC 38500, monitoring is a core governance responsibility. Assurance is the independent form of monitoring that feeds back into evaluation and direction.
4. Regulatory and legal compliance: Regulations such as SOX, GDPR, Basel and industry rules often require independent evidence that controls and governance are effective.
5. Builds trust and transparency: Investors, regulators, customers and partners gain confidence when governance is independently verified.
6. Drives continuous improvement: Findings show gaps in maturity, capability, policy and oversight, and they lead to corrective action.
7. Separates oversight from execution: Without independence, management effectively marks its own homework, which is a classic governance weakness.
What It Is
Assurance is an objective examination of evidence that provides an independent assessment of governance, risk management and control processes. It involves three parties:
- Responsible party: the process or control owner, usually management.
- Intended user: the board, audit committee or other stakeholders who rely on the results.
- Assurance provider: internal audit, external audit or another independent reviewer.
The Three Lines Model (IIA, updated 2020) frames who does what:
- First line: operational management, which owns and manages risk and delivers products and services, including IT operations and project teams.
- Second line: risk management, compliance, information security and similar functions. They provide expertise, monitoring and challenge, but they are not fully independent.
- Third line: internal audit. It provides independent, objective assurance and advice and reports functionally to the audit committee or board.
- External assurance providers: external auditors, regulators and independent consultants, who provide additional independent assurance.
Types of governance assurance include:
- Governance framework and maturity audits, such as COBIT capability assessments.
- Benefits realization audits and post-implementation reviews (PIRs).
- Portfolio and program reviews, such as stage-gate assurance and health checks.
- Compliance audits against policies, laws and standards.
- Risk management effectiveness reviews.
- Third-party assurance reports, such as SOC 1 and SOC 2 (SSAE 18 / ISAE 3402), for outsourced services.
Relevant frameworks:
- COBIT 2019: objective MEA04 (Managed Assurance), together with MEA01–MEA03, and EDM objectives that require assurance on governance.
- COBIT Focus Area: Assurance and the ISACA ITAF (IT Assurance Framework).
- ISO/IEC 38500: principles for governance of IT, including conformance.
- IIA Standards (Global Internal Audit Standards).
- Val IT concepts for value governance, which are now integrated into COBIT.
How It Works
1. Establish the assurance mandate and governance: The board or audit committee approves an audit charter that defines authority, scope, independence and reporting lines. Internal audit should report functionally to the audit committee and administratively to a senior executive such as the CEO. This structure protects objectivity.
2. Risk-based assurance planning: An annual or rolling assurance plan is built from enterprise risks, strategic priorities and major investments. High-value or high-risk programs receive more frequent and deeper review. The plan is coordinated across the three lines (combined assurance) to avoid gaps and duplication.
3. Define scope and criteria for each engagement: Typical criteria include COBIT governance objectives, approved policies, business case commitments, regulatory requirements and agreed KPIs and KGIs. Clear criteria are what make findings objective.
4. Gather and evaluate evidence: Techniques include interviews, document review (strategies, business cases, board minutes, portfolio reports), testing of controls, data analytics, and benchmarking against maturity models. For benefits realization, the auditor compares the benefits actually realized with the business case baseline. The auditor also checks benefit ownership, measurement methods and tracking.
5. Assess and conclude: The provider rates design adequacy and operating effectiveness, identifies root causes, and evaluates the impact on value, risk and resources.
6. Report: Results are communicated to management and to the audit committee or board. Reports state findings, risk ratings and recommendations, and they record management's agreed action plans with owners and dates.
7. Follow-up and monitoring: Assurance tracks remediation to closure and escalates overdue high-risk items to the board. Lessons learned feed back into governance improvement, portfolio decisions and future business cases.
Key Enablers and Principles
- Independence and objectivity: Assurance providers must not audit work they designed or operate.
- Competence: Reviewers need relevant expertise, such as CISA, CGEIT or domain experts.
- Combined assurance: Coordinating the three lines and external providers gives efficient coverage.
- Reliance on others: Auditors may rely on the work of other providers, such as SOC reports, after evaluating their competence and independence.
- Board ownership: The board is responsible for ensuring assurance exists, even though it delegates the work.
Common Pitfalls
- Treating second-line monitoring as independent assurance.
- Auditing only compliance rather than value delivery and benefits.
- No follow-up on findings.
- Internal audit reporting solely to the CIO, which impairs independence.
- Skipping post-implementation reviews once a project closes, so benefits are never validated.
- Over-reliance on vendor self-assessments without independent validation.
Exam Tips: Answering Questions on Independent Assurance and Audit of Governance
1. Think like a governance professional, not an auditor. CGEIT asks what the board or governance body should ensure, not how to perform detailed audit testing. Prefer answers about oversight, accountability and alignment over technical control steps.
2. Independence is king. If one option involves a party reviewing its own work, it is almost always wrong. The best answer usually involves internal audit reporting to the audit committee, or an external independent reviewer.
3. Know who reports to whom. Internal audit's functional reporting line goes to the audit committee or board. If asked how to improve independence, pick the option that moves reporting away from IT management.
4. Benefits are validated after implementation. For questions about confirming value, the best answer is often a post-implementation review or benefits realization review compared against the approved business case. It is not a check of project delivery on time and within budget.
5. Board-level responsibility. The board owns governance and must obtain assurance. It does not perform the audit itself. Options where the board "approves the assurance plan" or "receives independent reports" are strong.
6. Risk-based is the default. When asked how to prioritize assurance activities, choose risk-based planning aligned to enterprise objectives over cyclical or equal coverage.
7. Distinguish monitoring from assurance. Management dashboards and second-line reviews are monitoring. Independent assurance is objective third-line or external review. Questions often test this difference.
8. Follow-up matters. If findings were reported but nothing changed, the best answer focuses on tracking remediation and escalating to the board.
9. Outsourcing does not outsource accountability. For third-party services, the best answer is often to obtain independent assurance reports (SOC 2, ISAE 3402) or exercise right-to-audit clauses.
10. Watch for 'FIRST', 'BEST', 'MOST' keywords. The FIRST step is usually to understand the scope, criteria or business objectives. The BEST step is usually the most strategic and governance-oriented option.
11. Link to frameworks. Recognize COBIT MEA04 (Managed Assurance) and EDM monitoring, and the conformance principle in ISO/IEC 38500. Knowing these helps you eliminate distractors.
12. Eliminate operational distractors. Answers such as "install a tool", "increase testing frequency" or "replace staff" are rarely correct when a governance-level option exists.
Sample Question
An enterprise completed a major ERP implementation a year ago. The board wants to know whether the investment delivered the expected value. What is the BEST approach?
A. Ask the CIO to present project completion metrics.
B. Commission an independent post-implementation benefits review against the approved business case.
C. Survey end users on system satisfaction.
D. Review the project budget variance report.
Answer: B. It is independent, it is tied to the business case, and it focuses on value rather than delivery.
Why the others are weaker:
- A lacks independence and measures project delivery rather than value.
- C is too narrow.
- D addresses cost, not benefits.
Summary
Independent assurance and audit of governance give the board objective, evidence-based confidence that IT governance works and that IT-enabled investments realize their intended benefits. Remember these essentials:
- Independence (the third line and external providers).
- Board ownership.
- Risk-based planning.
- Validation against business cases.
- Follow-up to closure.
In the exam, choose the answer that is independent, governance-focused, value-oriented and accountable to the board.
