Finding Gaps and Overlaps with an Assurance Map

1. Why This Topic Matters

The CRMA (Certification in Risk Management Assurance) exam tests whether internal auditors can provide assurance over an organization's risk management processes and governance. A recurring theme in the Internal Audit Roles and Responsibilities domain is the Chief Audit Executive's (CAE's) duty to coordinate with other assurance providers so that the board and senior management receive complete, reliable and efficient assurance. The assurance map is the primary tool for doing this.

Why it matters in practice:
• Boards need confidence that every significant risk is being watched by someone competent and objective. A gap in assurance means a key risk may be unmonitored until it crystallizes into a loss, breach or scandal.
• Duplicated assurance wastes resources and creates 'assurance fatigue' in operational management, who may be audited, reviewed and inspected on the same control by three different functions in a single year.
• Reliance decisions – the IIA Standards require the CAE to coordinate activities and consider relying on the work of other internal and external assurance providers. The CAE cannot responsibly rely on anyone without first understanding who provides what assurance, over which risks, and to what quality. The assurance map makes this visible.
• Risk-based audit planning – identifying gaps tells the CAE where internal audit effort is most needed; identifying overlaps tells the CAE where effort can be reduced or redirected.

Because this topic sits at the intersection of risk management, governance and audit planning, examiners like it: it lets them test knowledge of the Three Lines Model, the IIA Standards on coordination and reliance, and the CAE's judgment all in one scenario.

2. What an Assurance Map Is

An assurance map (sometimes called a combined assurance map or assurance framework) is a structured document – usually a matrix – that plots the organization's significant risks (or key processes/control areas) against the sources of assurance that cover them. For each intersection it records the nature, scope, frequency and often the quality or rating of the assurance provided.

Typical layout:
• Rows: key risks, risk categories, or business processes drawn from the enterprise risk register or risk universe.
• Columns: assurance providers grouped by line of defence – for example, First Line (management self-assessment, operational controls, supervisory reviews), Second Line (risk management, compliance, legal, health & safety, information security, quality assurance, finance control), Third Line (internal audit), and External (external audit, regulators, certification bodies, consultants).
• Cells: an indication of coverage – often colour-coded (e.g., green = adequate assurance, amber = partial or unverified, red = none) – plus references to the actual assurance activity, its date and conclusion.

The map is a living governance tool, typically owned or facilitated by the CAE on behalf of the audit committee, but populated with input from risk management, compliance and management. It is not an audit of the risks themselves; it is a picture of who is providing assurance over what.

3. Key Concepts: Gaps and Overlaps

Assurance gap – a significant risk for which there is no assurance, or only assurance that is inadequate in scope, frequency, independence or competence. Examples:
• A strategic risk (e.g., reputational damage from a new product line) that no function reviews.
• A risk covered only by first-line self-assessment with no independent validation.
• A compliance area last reviewed five years ago, with no planned coverage.
• A third-party or outsourced process where the organization relies on a vendor's assertion with no independent report (e.g., no SOC report).

Assurance overlap (duplication) – the same risk or control is reviewed by two or more providers in a way that adds little incremental value. Examples:
• Internal audit, the compliance function and the external auditor all test the same anti-money-laundering control set in the same year using similar methods.
• A quality function and an internal audit team both perform near-identical site inspections.

Important nuance the exam often tests: not every overlap is bad. Layered assurance over a very high-impact risk may be deliberate and appropriate. Likewise, coverage is not the same as assurance – a cell that shows 'risk management reviewed this' is only meaningful if the review was competent, objective and recent. The CAE must evaluate the quality of assurance, not just its existence.

4. How the Process Works

Step 1 – Define the risk universe. Start from the enterprise risk register, strategic objectives and the audit universe. Agree with the board/audit committee which risks are 'significant' enough to belong on the map.

Step 2 – Identify all assurance providers. Inventory internal and external functions that provide any form of assurance, placing each within the Three Lines Model. Clarify roles and responsibilities so that everyone understands who is accountable for what.

Step 3 – Document existing assurance activity. For each risk/provider intersection record: what is reviewed, scope, methodology, frequency, last date performed, conclusion/rating, and reporting line. Collect evidence rather than relying on verbal claims.

Step 4 – Assess the adequacy and reliability of each assurance source. Consider the provider's independence and objectivity, competence, due professional care, the rigour of its methodology, and whether its work is subject to quality assurance. This is the basis for any reliance decision under the IIA Standards.

Step 5 – Analyse the map for gaps. Look for red or empty cells against high-rated risks; look for risks covered only by non-independent first-line assurance; look for assurance that is stale, narrow in scope, or of doubtful quality.

Step 6 – Analyse the map for overlaps. Identify risks with multiple providers performing similar work. Determine whether the overlap is intentional (layered assurance on a critical risk) or inefficient duplication.

Step 7 – Decide actions. Options include: adding internal audit engagements to the plan for gaps; asking a second-line function to extend scope; recommending management establish a new control or monitoring process; agreeing with another provider to rely on their work and redirecting internal audit effort; coordinating timing and scope to eliminate duplication; or deliberately retaining overlap where risk severity justifies it.

Step 8 – Report to the board/audit committee. Present the map, the identified gaps and overlaps, and the proposed response. Transparency about unmitigated gaps is essential – the board must consciously accept any residual uncovered risk.

Step 9 – Maintain and refresh. Update the map as risks change, assurance work is completed, and new providers emerge. Reconcile it periodically to the risk register and audit plan.

5. The CAE's Role and Responsibilities

• Facilitator and coordinator, not the sole owner of all assurance. The CAE typically champions the map because internal audit has the broadest view of the organization and is the most independent internal function.
• Must preserve independence. Internal audit can coordinate and facilitate, but accountability for risk management remains with management; the CAE should not take on second-line ownership of risks.
• Reliance judgment. Where the CAE chooses to rely on another provider, the CAE remains responsible for the conclusions internal audit draws and must have evaluated the other provider's competence, objectivity and work.
• Reporting. The CAE communicates the overall adequacy of assurance coverage to senior management and the board, including significant gaps, and uses the map to justify the risk-based audit plan.
• Using the map in audits of risk management. In a CRMA context, the map also helps internal audit evaluate whether the organization's risk management framework ensures that key risks are appropriately monitored and reported.

6. Common Pitfalls

• Treating a filled cell as proof of assurance without assessing quality or independence.
• Mapping functions rather than risks (losing sight of what actually matters to objectives).
• Building the map once and never updating it.
• Internal audit filling every gap itself instead of recommending the most appropriate provider (often management or second line).
• Eliminating overlap on a critical risk purely for efficiency, thereby reducing assurance below what the board requires.
• Failing to escalate unresolved gaps to the board.

7. Exam Tips: Answering Questions on Finding Gaps and Overlaps with an Assurance Map

Tip 1 – Anchor every answer in the purpose. The purpose of an assurance map is to give the board and senior management a consolidated view of assurance coverage over significant risks so that gaps and duplication can be identified and addressed. If an option describes the map as a tool to 'test controls', 'rate risks' or 'replace the audit plan', it is a distractor.

Tip 2 – Know the structure. Expect questions asking what goes on the axes. Correct answer: significant risks (or processes) against assurance providers/lines of defence. Cells show the nature and adequacy of assurance.

Tip 3 – Recognise a gap when you see one. Scenario clues: 'no function currently reviews', 'last reviewed several years ago', 'only management self-assessment', 'the outsourced provider has not supplied an independent report', 'the risk was newly added to the register'. The correct response is usually to flag the gap, assess its significance, and either add it to the audit plan or recommend the appropriate line of defence provide coverage – and report it to the audit committee.

Tip 4 – Recognise an overlap. Scenario clues: multiple functions testing the same controls, management complaining about repeated reviews, external audit and internal audit covering the same area. The best answer is normally to coordinate scope and timing, consider reliance on the other provider after evaluating its competence and objectivity, and redeploy internal audit resources to higher-risk or uncovered areas.

Tip 5 – Beware of 'efficiency at all costs' distractors. If a question involves a very high-impact risk, the 'most appropriate' answer may be to retain layered assurance rather than eliminate it. Read the risk rating in the scenario carefully.

Tip 6 – Apply the reliance rules. The CAE may rely on other providers only after evaluating their independence/objectivity, competence and the quality of their work, and the CAE retains responsibility for internal audit's own conclusions. Any option implying automatic or unverified reliance is wrong.

Tip 7 – Use the Three Lines Model vocabulary. Questions often ask who should fill a gap. Default logic: management (first line) owns and controls the risk; second-line functions monitor and provide oversight; internal audit (third line) provides independent assurance. Internal audit should not become the permanent monitor of an operational risk – that compromises independence. The 'best' answer frequently recommends management or second line establish monitoring, with internal audit providing periodic independent assurance.

Tip 8 – 'Who owns the map?' Typical correct answer: the CAE facilitates/coordinates it on behalf of the audit committee or board, with input from risk management, compliance and management. Ownership of the underlying risks stays with management.

Tip 9 – Sequence questions. If asked what to do first, start with defining the significant risks/risk universe and identifying assurance providers – not with scheduling audits. Analysis of gaps and overlaps comes after the map is populated and assessed for quality.

Tip 10 – Reporting is always part of the answer. Where a scenario reveals a significant uncovered risk, the CAE must communicate it to senior management and the board/audit committee. Options that keep the gap within internal audit or quietly add it to next year's plan without escalation are generally inferior.

Tip 11 – Watch for 'coverage versus assurance' traps. An option that says 'the risk is adequately assured because the compliance function reviews it annually' is incomplete if the scenario hints the compliance team lacks skills or independence. The best answer evaluates the quality of that assurance.

Tip 12 – Eliminate options by role violation. Any choice where internal audit designs controls, owns the risk register, makes management decisions about risk appetite, or signs off assurance it has not evaluated breaches independence/objectivity and can be eliminated.

Tip 13 – Prefer 'most appropriate / best' phrasing logic. CRMA questions often have several plausible options. Choose the one that is risk-based, preserves independence, involves the right line of defence, and communicates to governance. The option that satisfies the most of these criteria is usually correct.

8. Quick Revision Summary

• Assurance map = matrix of significant risks × assurance providers, showing nature and adequacy of coverage.
• Purpose = holistic view for board; identify gaps (no/insufficient/unreliable assurance) and overlaps (duplication).
• Built from the risk register; populated with evidence; assessed for quality (independence, competence, scope, frequency).
• CAE facilitates, coordinates, decides on reliance, drives the risk-based audit plan, and reports gaps to the audit committee.
• Gaps → recommend appropriate line of defence provide coverage, add to audit plan if warranted, escalate.
• Overlaps → coordinate, rely where justified, redeploy effort – but keep layered assurance on critical risks.
• Keep the map current; it is a living governance tool, not a one-off exercise.

Master these principles and the vocabulary of the Three Lines Model and reliance, and you will be well equipped to handle any CRMA question on finding gaps and overlaps with an assurance map.