Coordinating Assurance Across Providers

Why This Topic Matters

In modern organizations, internal audit is rarely the only function providing assurance. Risk management, compliance, information security, quality assurance, health and safety, external auditors, regulators, and specialist consultants all deliver some form of assurance over risks and controls. Without coordination, this creates two serious problems: duplication (the same area reviewed repeatedly, exhausting management and wasting resources) and gaps (critical risks that everyone assumes someone else is covering). For the CRMA candidate, this topic sits at the heart of internal audit's role in enterprise risk management, because the Chief Audit Executive (CAE) is uniquely positioned to see the whole assurance landscape and to help the board understand whether the organization's key risks are adequately covered.

The IIA's Global Internal Audit Standards explicitly require the CAE to coordinate with other internal and external assurance providers and to consider relying on their work where appropriate. This is not optional good practice; it is a professional requirement. Exam questions frequently test whether you understand who is responsible for coordination, how reliance is justified, and what tools are used to achieve a coordinated view.

What Is Coordinating Assurance Across Providers?

Coordinating assurance means deliberately aligning the activities of all parties who provide assurance over governance, risk management, and control so that the board and senior management receive comprehensive, efficient, and non-duplicative coverage of the organization's significant risks.

Key concepts you must know:

1. Assurance providers. These are typically grouped into three categories:
- Management-based functions (first line activities and second line functions such as risk management, compliance, legal, quality, environmental and safety, information security).
- Internal audit (the independent third line providing objective assurance to the board).
- External providers (external auditors, regulators, certification bodies, specialist consultants, and outsourced service providers' assurance reports such as SOC reports).

2. The Three Lines Model. The IIA's Three Lines Model describes how these roles relate. The first line owns and manages risk; the second line provides expertise, support, monitoring, and challenge on risk matters; the third line (internal audit) provides independent and objective assurance and advice. The governing body oversees all of this. Coordination among the lines is essential to achieving effective governance.

3. Combined assurance (or integrated assurance). This is the practice of bringing together assurance from all providers into a single, coherent picture mapped against the organization's key risks. It originated prominently in South Africa's King Code of governance and has been widely adopted. The goal is a single view the audit committee can rely upon.

4. Assurance mapping. An assurance map is the central tool. It is a matrix that lists the organization's significant risks (often from the risk register or risk universe) on one axis and the assurance providers on the other, showing who provides what level of assurance over each risk. It reveals where coverage is duplicated, where it is thin, and where it is absent entirely.

How It Works in Practice

Step 1: Understand the risk universe. Coordination begins with the organization's key risks, usually drawn from the enterprise risk management framework. Internal audit should align its understanding with management's risk assessment while retaining its own independent judgment.

Step 2: Identify all assurance providers and their scope. The CAE inventories who is providing assurance, over what, with what frequency, and using what methodology. This includes second-line functions and external parties.

Step 3: Build the assurance map. Risks are plotted against providers, and the level and nature of assurance is rated (for example, by color coding: strong, moderate, limited, none). The map is reviewed with senior management and the audit committee.

Step 4: Analyze gaps and overlaps. Where coverage is duplicated, the CAE negotiates to reduce redundancy. Where gaps exist, the CAE either adds coverage to the internal audit plan or escalates the gap to the board so management can assign responsibility.

Step 5: Evaluate reliance. Before relying on another provider's work, internal audit must assess that provider's independence/objectivity, competence, and the due professional care and methodology applied. The Standards make clear that the CAE remains accountable for conclusions in the internal audit report even when relying on others, so reliance decisions must be documented and justified. Internal audit may need to perform additional testing to supplement the reliance.

Step 6: Reflect coordination in the audit plan. The risk-based internal audit plan should explicitly consider other assurance activities so that internal audit resources are deployed where they add the most value, not where another competent function has already delivered reliable assurance.

Step 7: Communicate. The CAE communicates to the board and senior management on the overall adequacy of assurance coverage, not just on internal audit's own work. Sharing of information with other providers should be managed with attention to confidentiality and the sensitivity of findings.

Step 8: Maintain ongoing dialogue. Coordination is continuous, not a once-a-year exercise. Regular meetings with the external auditor, risk and compliance leads, and others keep the map current as risks and provider activities change.

Roles and Responsibilities

- The board / audit committee oversees the overall assurance framework, approves the internal audit plan, and should receive a consolidated view of coverage. Ultimately the board is responsible for ensuring adequate assurance exists over key risks.
- Senior management is responsible for establishing risk management and control, and for the second-line functions that monitor them.
- The CAE is responsible for coordinating with other providers, assessing reliability of their work, minimizing duplication, identifying gaps, and reporting on coverage. The CAE often facilitates combined assurance but does not own the risks or the first- and second-line activities.
- Other assurance providers are responsible for the quality of their own work and for sharing relevant information.

A crucial distinction: the CAE coordinates and may facilitate, but should not assume management's responsibility for risk ownership or for the second-line functions, as this would impair independence.

Benefits of Coordination

- Reduced duplication and lower overall assurance cost.
- Reduced burden on operational management (fewer repeated interviews and requests).
- A holistic view of risk coverage for the board.
- Identification of uncovered risks before they crystallize.
- Better allocation of scarce internal audit resources to high-risk, uncovered areas.
- Improved consistency in risk language, rating scales, and reporting.

Common Challenges

- Different providers use different risk taxonomies and rating scales, making comparison difficult.
- Second-line functions may lack sufficient objectivity for internal audit to rely on their work without additional testing.
- Confidentiality concerns may limit information sharing, especially with external parties.
- Turf protection and resistance from functions who fear loss of scope.
- Risk that internal audit becomes overly reliant on others and loses its independent perspective.
- Keeping the assurance map current as the organization changes.

Exam Tips: Answering Questions on Coordinating Assurance Across Providers

Tip 1: Remember that the CAE owns the coordination responsibility. When a question asks who is responsible for coordinating with other internal and external assurance providers and considering reliance on their work, the answer is the CAE, not the audit committee, not the CRO, and not the external auditor. The audit committee oversees; the CAE coordinates.

Tip 2: Know the reliance criteria. Expect questions on what internal audit must assess before relying on another provider's work. The answer will revolve around the provider's objectivity/independence, competence/qualifications, and the adequacy of their methodology and due care. If an option mentions simply accepting the work because the provider is a reputable firm or because management says so, it is wrong.

Tip 3: Accountability is never transferred. A favorite exam trap: when internal audit relies on another provider's work, the CAE remains responsible for the conclusions in the internal audit report. Any answer suggesting that reliance shifts accountability to the other provider is incorrect.

Tip 4: Identify the assurance map as the primary tool. Questions describing a desire to see where risks are covered, over-covered, or not covered at all are pointing you to an assurance map or combined assurance framework. Do not confuse this with a risk register (which lists risks, not assurance coverage) or a control matrix (which maps controls to risks, not providers to risks).

Tip 5: Watch for independence traps. If a scenario has the CAE taking ownership of risk management, managing the compliance function, or deciding which risks management should accept, the correct answer will flag the impairment to independence. Coordination and facilitation are fine; ownership and management decision-making are not.

Tip 6: Gaps get escalated, duplication gets eliminated. When a scenario reveals a key risk with no assurance coverage, the best answer usually involves the CAE either incorporating it into the audit plan (if resources allow and it is appropriate) or reporting the gap to the board and senior management so responsibility can be assigned. When a scenario reveals heavy duplication, the best answer involves reducing redundant work through coordination, not simply continuing everything as before.

Tip 7: Apply Three Lines Model logic. Be ready to classify functions correctly. Risk management and compliance are second line; internal audit is third line; the external auditor is an external provider. Questions may ask which line a function belongs to or which provider offers the most independent assurance (internal audit among internal providers; external auditor among external ones).

Tip 8: Choose the most comprehensive and board-focused option. CRMA questions often present several plausible actions. The best answer typically is the one that provides the board with a complete view of assurance over key risks and is grounded in risk-based prioritization, rather than a narrow procedural step.

Tip 9: Reliance on second-line work requires caution. If a question involves relying on a second-line function (e.g., compliance testing), recognize that these functions report to management and may lack full objectivity. The correct answer usually involves assessing their objectivity and competence and possibly performing supplementary testing, rather than relying fully or refusing to rely at all.

Tip 10: Look for the words frequency, scope, and methodology. When evaluating coordination with the external auditor, the typical areas of coordination include audit coverage, access to each other's work programs and reports, exchange of information, and common understanding of techniques, methods, and terminology. Options reflecting these elements are usually correct.

Tip 11: Eliminate extremes. Options that say internal audit should never rely on others, or should always rely on others, or should audit everything itself are almost always wrong. The Standards call for judgment, documented evaluation, and risk-based coverage.

Quick Recap for Revision

- Coordination is a CAE responsibility under the Standards.
- Purpose: eliminate duplication, close gaps, provide a holistic view to the board.
- Primary tool: the assurance map (combined assurance).
- Framework: the Three Lines Model.
- Reliance requires assessing objectivity, competence, and methodology; accountability stays with the CAE.
- Internal audit coordinates and facilitates but never takes ownership of risks or management functions.
- Gaps are escalated; duplication is reduced; the audit plan reflects what others already cover.

Master these principles and the logic behind them, and you will be well prepared to handle any scenario-based question on coordinating assurance across providers in the CRMA exam.