Combined Assurance

1. Why Combined Assurance Matters

Modern organisations receive assurance from many sources: management self-assessments, risk and compliance functions, quality teams, health and safety officers, internal audit, external audit, regulators and specialist consultants. When these providers work in isolation, the board and audit committee receive a fragmented, duplicated and sometimes contradictory picture of how well risks are being managed. Some risks are reviewed five times a year by different teams; others are never reviewed at all. Combined assurance exists to solve this problem.

For the CRMA candidate, combined assurance is important because:
- It sits at the heart of the internal audit function's responsibility to coordinate with other assurance providers and to rely on their work where appropriate.
- It is explicitly referenced in the IIA's Global Internal Audit Standards (Standard 9.5, Coordination and Reliance) and in the former 2017 IPPF Standard 2050 (Coordination and Reliance).
- It underpins the Three Lines Model, which clarifies how management, specialist functions and internal audit each contribute assurance.
- It allows the chief audit executive (CAE) to give the board a holistic opinion on governance, risk management and control while using scarce audit resources efficiently.
- Governance codes such as King IV (South Africa) formally require boards to adopt a combined assurance model, and the concept has spread globally through regulators and listing requirements.

2. What Combined Assurance Is

Definition: Combined assurance is a coordinated approach in which all assurance providers within and outside the organisation align their activities so that, collectively, they provide the governing body and senior management with comprehensive, efficient and non-duplicative assurance over the organisation's significant risks and controls.

Key features of the concept:
- Coordination: assurance activities are planned and scheduled together rather than independently.
- Coverage: all significant risks receive an appropriate level of assurance; gaps and overlaps are identified and addressed.
- Reliance: internal audit may rely on the work of other providers, after assessing their competence, objectivity and due professional care, to reduce duplication.
- Reporting: results from all providers are integrated into a single, coherent view for the board and audit committee.
- Accountability: the board (through the audit committee) retains ultimate responsibility for ensuring the assurance model is effective; management is accountable for designing and operating it; internal audit frequently facilitates or coordinates it.

Origin: The term was popularised by the King III Report on Corporate Governance (2009) and strengthened in King IV (2016), which describes a combined assurance model incorporating and optimising all assurance services and functions so that, taken as a whole, they support the integrity of information used for decision making and reporting.

3. The Three Lines Model and Assurance Providers

Combined assurance is easiest to understand through the IIA's Three Lines Model (2020), which replaced the older Three Lines of Defence:

- First line roles (operational management): own and manage risks, operate controls and provide first-hand assurance through monitoring, supervision and control self-assessment.
- Second line roles (risk management, compliance, information security, quality, legal, health and safety): provide expertise, support, monitoring and challenge on risk matters; they give assurance to management on specific risk areas.
- Third line (internal audit): provides independent and objective assurance and advice to the governing body and management on the adequacy and effectiveness of governance, risk management and control.
- External assurance providers (external auditors, regulators, certification bodies, actuaries, specialist consultants): provide additional, independent assurance, often with a statutory or contractual mandate.

Combined assurance maps every significant risk to the assurance it receives from each of these sources and evaluates whether the total is sufficient, excessive or missing.

4. How Combined Assurance Works in Practice

Step 1 – Obtain board and executive sponsorship. The audit committee typically approves the combined assurance framework and holds management accountable for it. Without senior sponsorship, assurance providers tend to protect their own territory.

Step 2 – Identify significant risks. Start with the organisation's risk register or risk universe. Combined assurance is risk-based: only significant risks need full coverage.

Step 3 – Identify all assurance providers. List every internal and external function that provides assurance, and define the scope, frequency and nature of their work.

Step 4 – Build the assurance map. An assurance map (or assurance matrix) is the central tool of combined assurance. Rows list significant risks or business processes; columns list assurance providers (first line, second line, internal audit, external). Each cell records the nature, timing and extent of assurance given. Colour coding often shows strong coverage, partial coverage, gaps and over-assurance.

Step 5 – Assess the quality of each assurance source. Before relying on another provider, internal audit must evaluate: (a) the provider's organisational independence and objectivity; (b) the competence and qualifications of its staff; (c) the methodology and due professional care applied; (d) the scope and timing of the work; (e) the evidence supporting conclusions. Reliance on second line work is usually lower than reliance on external audit because second line functions are part of management.

Step 6 – Identify gaps and duplication. Where a significant risk receives little or no assurance, the plan must be adjusted. Where a risk is covered by multiple providers, roles are rationalised or internal audit relies on others' work.

Step 7 – Coordinate plans and schedules. Internal audit, risk, compliance and external audit align annual plans to share information, avoid auditing the same area in the same quarter and leverage each other's findings.

Step 8 – Integrate reporting. Consolidated assurance reports to the audit committee show, for each significant risk, the overall assurance conclusion and the sources supporting it. Internal audit's overall opinion may draw on other providers' work, but the CAE remains responsible for that opinion and must disclose the extent of reliance.

Step 9 – Monitor and refresh. The assurance map is updated as risks change, new functions emerge and findings are remediated.

5. Internal Audit's Role in Combined Assurance

Internal audit's role can take several forms, depending on the organisation's maturity:
- Participant: internal audit is one assurance provider among many, contributing to the map and coordinating its plan with others.
- Facilitator or coordinator: internal audit often leads the development of the assurance map because of its enterprise-wide view, independence and reporting line to the audit committee. This is acceptable provided internal audit does not assume management's responsibility for risk management or for the operation of second line functions.
- Evaluator: internal audit can assess the effectiveness of the combined assurance model itself and report to the board on whether it is functioning.

Safeguards: Internal audit must preserve its independence. It should not design controls or own risks, should not be the sole second line function in disguise, and must document any reliance decisions. Under Standard 9.5, the CAE must coordinate with internal and external providers of assurance services and consider relying upon their work; when relying on others, the CAE remains responsible for the conclusions reached.

6. Benefits of Combined Assurance

- Comprehensive coverage of significant risks with no unintended gaps.
- Reduced duplication, audit fatigue and cost for the business.
- Better use of scarce internal audit resources, allowing focus on areas of highest risk or weakest existing assurance.
- A single, consistent assurance message to the board, improving decision making.
- Stronger collaboration and knowledge sharing among assurance functions.
- Support for integrated reporting and for the board's statements on risk and internal control.
- Clearer accountability across the Three Lines.

7. Challenges and Limitations

- Independence and objectivity concerns: second line functions are part of management, so their assurance is inherently less independent than internal audit's.
- Inconsistent quality: different providers use different methodologies, rating scales and evidence standards, making aggregation difficult.
- Territorial behaviour and silos: functions may resist sharing information or ceding scope.
- False comfort: a fully coloured assurance map can create an illusion of coverage if the underlying work is weak. The map must show quality, not just activity.
- Resource and maturity requirements: building and maintaining an assurance map requires time, a robust risk register and strong governance.
- Responsibility for conclusions: internal audit cannot outsource accountability; if it relies on flawed work, its own opinion is impaired.

8. Combined Assurance Versus Related Concepts

- Combined assurance vs integrated assurance: the terms are often used interchangeably; integrated assurance sometimes emphasises a single assurance framework and shared methodology, while combined assurance emphasises coordination of existing providers.
- Combined assurance vs Three Lines Model: the Three Lines Model describes who does what in governance and risk; combined assurance is the process of coordinating assurance across those lines.
- Combined assurance vs relying on the work of others: reliance is one outcome of combined assurance, but combined assurance is broader, covering mapping, planning, gap analysis and integrated reporting.
- Assurance map vs risk register: the risk register records risks, owners, ratings and responses; the assurance map overlays this with the sources and quality of assurance.

9. Exam Tips: Answering Questions on Combined Assurance

Tip 1 – Know the purpose words. Examiners test whether you understand that combined assurance aims to achieve comprehensive coverage, eliminate gaps and duplication, and give the board a holistic view. If an answer choice describes replacing internal audit with other functions, increasing total assurance activity, or reducing the board's oversight role, it is almost always wrong.

Tip 2 – Remember who is accountable. The governing body (audit committee) is ultimately responsible for ensuring an effective combined assurance model; management is responsible for designing and operating it; the CAE coordinates and may facilitate. Any option that makes internal audit responsible for managing risks or for the performance of second line functions violates independence.

Tip 3 – Link to the Standards. Expect references to coordination and reliance (Global Internal Audit Standards 9.5; formerly 2017 Standard 2050). The key principles: the CAE must coordinate activities with other assurance providers, may rely on their work after evaluating competence, objectivity and due professional care, and retains responsibility for internal audit's conclusions. If an option says internal audit can simply accept another provider's conclusions without evaluation, it is incorrect.

Tip 4 – Recognise the assurance map. Questions often describe a matrix of risks against assurance providers and ask what it is or how it should be used. The correct answer typically involves identifying gaps and overlaps, prioritising the audit plan or supporting the overall opinion. Do not confuse it with a risk register, a heat map or a control matrix.

Tip 5 – Apply the Three Lines Model correctly. Be able to classify functions: operational management is first line; risk, compliance, quality and information security are second line; internal audit is third line; external audit and regulators are external. Remember the 2020 model uses the term Three Lines, not lines of defence, and emphasises collaboration rather than rigid separation.

Tip 6 – Watch for independence traps. Scenario questions may ask how much internal audit should rely on a second line function that reports to the chief operating officer, or on work performed by staff who recently moved from the area under review. The right answer recognises reduced objectivity and calls for more internal audit testing, not less.

Tip 7 – Distinguish benefits from limitations. If asked for a benefit, choose efficiency, coverage, reduced duplication or integrated reporting. If asked for a limitation or risk, choose over-reliance, false comfort, inconsistent quality or compromised independence. Read the stem carefully for words like most likely, primary, least or not.

Tip 8 – Use the implementation sequence. When a question asks for the first step in establishing combined assurance, the answer is usually to obtain board or audit committee support and identify significant risks, not to begin drafting reports or rationalising audit plans. When asked for the final step, think integrated reporting and ongoing monitoring.

Tip 9 – Connect to the overall opinion. Questions on the CAE's annual or overall opinion frequently involve combined assurance. The correct approach is that the CAE may incorporate other providers' work, must disclose the extent of reliance, and must ensure that sufficient internal audit work supports any conclusion issued under internal audit's name.

Tip 10 – Think like a CRMA. The CRMA exam emphasises the internal auditor's role in risk management assurance. Frame your answers around how combined assurance helps the board understand whether significant risks are being managed within appetite, while keeping internal audit independent and objective. When two options seem plausible, pick the one that best preserves independence and provides the board with the most complete, reliable view.

10. Quick Revision Summary

- Combined assurance coordinates all assurance providers so that significant risks are covered comprehensively, efficiently and without duplication.
- It is grounded in the Three Lines Model and the IIA Standards on coordination and reliance.
- The assurance map is the core tool: risks on one axis, assurance providers on the other, with quality and coverage assessed in each cell.
- The board is accountable; management operates the model; internal audit coordinates, contributes and may evaluate it.
- Internal audit may rely on others only after assessing competence, objectivity and due care, and always retains responsibility for its own conclusions.
- Benefits: coverage, efficiency, integrated reporting, better decisions. Risks: over-reliance, false comfort, inconsistent quality, weakened independence.
- In the exam, favour answers that improve coverage and coordination, preserve internal audit independence and keep accountability with the board and management.