Maintaining and Updating the Assurance Map
5 minutes
5 Questions
Maintaining and updating the assurance map is a continuous responsibility within the Certification in Risk Management Assurance (CRMA) framework and a core element of internal audit's coordinating role. An assurance map is a visual and analytical tool that links an organization's key risks to the assurance providers across the three lines: management controls (first line), risk, compliance and other oversight functions (second line), and internal audit (third line), supplemented by external assurance such as external auditors and regulators. Because risks, structures and assurance activities change constantly, a static map quickly loses relevance, so it must be treated as a living document. Internal audit typically acts as the custodian or facilitator of the map, even though ownership of the underlying risks rests with management. Maintenance begins with periodic refreshes of the risk universe, usually aligned with the enterprise risk management cycle and the annual audit planning process. New or emerging risks, such as cyber threats, ESG obligations or regulatory changes, are added, while obsolete risks are retired. Each risk's inherent and residual ratings are revalidated with risk owners. Next, assurance coverage is reassessed. Auditors confirm which functions are actually providing assurance over each risk, the nature and depth of that assurance, its frequency and the reliability of the provider. Changes in organizational structure, outsourcing arrangements or new second-line functions must be reflected. This analysis exposes gaps where critical risks receive insufficient assurance and overlaps where duplicated effort wastes resources, allowing the chief audit executive to rebalance the audit plan and recommend adjustments to management. Updates should be documented with version control, approved through governance channels and reported to the audit committee, which relies on the map to form a holistic view of assurance. Regular dialogue with assurance providers, clear ownership, and integration with risk registers and audit management systems ensure the map remains accurate, credible and useful for decision-making.
Maintaining and Updating the Assurance Map: A Complete CRMA Study Guide
1. Why This Topic Matters
An assurance map is only as valuable as it is current. Organizations change constantly: new regulations arrive, business units are acquired or divested, systems are replaced, key risk owners leave, and the risk profile shifts with strategy and the external environment. An assurance map built once and left on a shelf quickly becomes misleading, giving the board and audit committee false comfort that risks are covered when they may not be, or hiding costly duplication among assurance providers.
For the CRMA exam, this topic sits within Domain I: Internal Audit Roles and Responsibilities Related to Risk Management. The exam tests whether you understand that internal audit's involvement with the assurance map is an ongoing, cyclical responsibility, not a one-time project, and that the chief audit executive (CAE) uses the map to coordinate with other providers, decide where reliance is appropriate, and shape a risk-based internal audit plan. It also connects directly to the IIA's requirements on coordination and reliance (Standard 2050 in the 2017 Standards and Standard 9.5 in the 2024 Global Internal Audit Standards) and to the Three Lines Model.
2. What Is an Assurance Map? (Quick Recap)
An assurance map is a structured document, often a matrix, that links the organization's key risks (rows) to the sources of assurance over those risks (columns). Sources of assurance typically include:
- First line: management and operational controls, self-assessments, supervisory reviews
- Second line: risk management, compliance, legal, quality, health and safety, information security functions
- Third line: internal audit
- External providers: external auditors, regulators, certification bodies, consultants
Each cell shows the type, extent, and sometimes the quality or rating of assurance provided. The map reveals gaps (risks with little or no assurance), overlaps (multiple providers covering the same ground), and over-reliance on a single, perhaps untested, source. The board and audit committee use it to form a holistic view of assurance; the CAE uses it to coordinate work, avoid duplication, and target scarce audit resources.
3. What Does Maintaining and Updating Mean?
Maintaining means keeping the map accurate and usable through disciplined ownership, version control, defined refresh cycles, and stakeholder validation. Updating means revising the content, the risks, the providers, the coverage, and the assessed reliability of assurance, whenever a trigger event occurs or on a scheduled cycle, so the map reflects current reality.
Key principles examiners expect you to know:
- The assurance map is a living document, aligned to the organization's risk universe and risk assessment cycle.
- Internal audit typically facilitates and coordinates the map; it does not own the risks or the first and second line assurance activities. Ownership of the risk framework stays with management; oversight stays with the board and audit committee.
- Updates must be evidence-based: changes to the map should follow from risk assessments, audit results, provider evaluations, and governance decisions, not from assumptions.
- Independence must be preserved. Internal audit can maintain the map as a coordination tool, but if it takes management responsibility for second line assurance activities, it must apply safeguards and disclose the impairment.
4. How It Works: The Update Cycle
Step 1: Establish governance and ownership. Define who owns the map (frequently the CAE as coordinator, with the audit committee as sponsor), who contributes (risk, compliance, management, external providers), how often it is refreshed, and how changes are approved and communicated. Document the methodology so updates are consistent over time.
Step 2: Monitor for triggers. Common events that require an update:
- Changes to the risk register or risk universe (new, emerging, or retired risks; changes in likelihood, impact, or risk appetite)
- Organizational change: mergers, acquisitions, divestitures, restructuring, new business lines, geographic expansion
- Regulatory and legal change creating new compliance obligations
- New systems, technology, or processes that change the control environment
- Changes in assurance providers: a compliance function is created, outsourced, downsized, or reorganized; a new external auditor is appointed; a certification lapses
- Results of assurance work: audits, external reviews, or incidents reveal that an assurance source is less reliable than assumed, or that a control area has deteriorated
- Board or audit committee requests for assurance on specific areas
- Scheduled refresh, usually at least annually, synchronized with the enterprise risk assessment and the internal audit planning cycle
Step 3: Reassess the risk dimension. Confirm the list of key risks is complete and current. Use the latest enterprise risk assessment, strategic plans, and discussions with senior management and the board. Remove obsolete risks, add emerging ones, and update ratings and risk owners.
Step 4: Reassess the assurance dimension. For each risk, identify who provides assurance now, what they actually do (scope, frequency, depth), and how reliable that assurance is. Evaluate providers for competence, objectivity, independence from the activity assessed, and due professional care, and consider whether their work is documented and can be tested. Reliability assessments often drive the color or rating assigned to each cell.
Step 5: Identify gaps, overlaps, and reliance decisions. Compare the updated coverage with the risk ratings and the board's assurance expectations. Highlight high risks with thin or untested assurance (gaps), areas where several providers do similar work (duplication), and areas where internal audit could rely on others to reduce its own effort. Reliance should be stronger where provider reliability is high and the risk is lower; direct internal audit testing should be prioritized where risk is high and other assurance is weak or unproven.
Step 6: Validate with stakeholders. Share draft changes with risk owners, second line functions, and senior management to confirm accuracy. Disagreements about coverage should be resolved through discussion and evidence, and material differences escalated.
Step 7: Report and act. Present the updated map, with the key changes, gaps, duplications, and recommendations, to senior management and the audit committee. Feed the results into the risk-based internal audit plan, coordination agreements with other providers, and management action plans to close gaps. Record the version, date, and approver.
Step 8: Embed continuous improvement. Capture lessons from each cycle, refine the methodology, and consider technology (GRC tools) to keep the map linked dynamically to the risk register and audit universe.
5. Internal Audit's Specific Responsibilities
- Coordinate with internal and external assurance providers to share information and minimize duplication.
- Evaluate reliability of other providers before placing reliance; the CAE remains accountable for conclusions drawn from relied-upon work.
- Align the audit plan to the map so that resources flow to high-risk, low-assurance areas and reliance is used where justified.
- Communicate the overall state of assurance and significant gaps to the board and audit committee.
- Preserve independence: facilitating the map is a consulting-type activity; internal audit should avoid owning or performing the second line assurance it later evaluates.
- Promote a common risk language so all providers classify risks consistently, which is essential for a map to stay coherent over time.
6. Common Pitfalls
- Treating the map as a one-off deliverable with no refresh cycle
- Updating risks but not the assurance providers, or vice versa
- Accepting assertions of coverage from providers without assessing scope or quality
- Inconsistent risk terminology across functions, making the map impossible to reconcile
- Failing to connect updates to the audit plan or to action plans for gaps
- Internal audit taking on management responsibility for filling gaps rather than recommending that management do so
- Not communicating changes to the audit committee, so governance decisions rest on stale information
7. Exam Tips: Answering Questions on Maintaining and Updating the Assurance Map
Tip 1: Look for the word that signals change. If a scenario mentions an acquisition, a new regulation, a new ERP system, a reorganized compliance team, or a shift in risk appetite, the expected answer almost always involves updating the assurance map and reassessing coverage before adjusting the audit plan.
Tip 2: Default to the facilitator role. When asked who should own, prepare, or update the map, remember that internal audit coordinates and facilitates, management owns the risks and controls, and the board or audit committee provides oversight and approves. Answers that have internal audit owning risks, designing second line controls, or performing management duties are usually wrong because they impair independence.
Tip 3: Frequency answers favor alignment, not fixed numbers. If options include a rigid interval versus alignment with the risk assessment cycle and significant changes, choose at least annually and whenever significant changes occur, aligned with the enterprise risk assessment and audit planning.
Tip 4: Reliance requires evaluation. Any option suggesting internal audit can rely on another provider simply because it appears on the map is a distractor. The correct answer includes assessing the provider's competence, objectivity, and the quality of work and recognizing that the CAE remains accountable.
Tip 5: Gaps go to management and the board. When the update reveals a high risk with little assurance, the best response is to report the gap to senior management and the audit committee and recommend how it should be addressed, and to consider adding the area to the audit plan, not for internal audit to quietly assume the assurance role itself.
Tip 6: Duplication is solved by coordination. If the scenario describes several functions reviewing the same area, the right action is coordination of scope and timing, information sharing, and possibly reliance, rather than internal audit unilaterally withdrawing or ignoring the overlap.
Tip 7: Sequence matters in process questions. Expect questions asking what to do first. The typical order is: identify the trigger or change, update the risks, update the assurance providers and their reliability, analyze gaps and overlaps, validate with stakeholders, report to governance, then revise the audit plan. Choosing revise the audit plan before reassess coverage is a common trap.
Tip 8: Remember the purpose. The ultimate goal is a holistic, current view of assurance that supports board oversight and efficient use of resources. When two answers both seem reasonable, pick the one that best serves that purpose and best fits the Three Lines Model.
Tip 9: Watch for independence red flags. Options that have internal audit monitoring and updating the map while also performing the second line compliance testing recorded on it without safeguards or disclosure are designed to test whether you recognize an impairment.
Tip 10: Use Standards language. Phrases like coordination and reliance, risk-based plan, communicate with the board, and evaluate the reliability of other assurance providers often mark the correct option. Vague answers about improving efficiency without reference to risk or governance are typically distractors.
8. Quick Revision Summary
- The assurance map is a living document linking key risks to assurance providers across all three lines and external sources.
- It must be maintained (governance, ownership, version control, validation) and updated (triggers and scheduled refresh) to remain reliable.
- Internal audit facilitates and coordinates; management owns risks and controls; the board oversees.
- Updates follow a cycle: trigger, reassess risks, reassess assurance and reliability, identify gaps and overlaps, validate, report, revise the audit plan.
- Reliance on others requires evaluation; the CAE stays accountable.
- Gaps and duplications are reported and coordinated, not absorbed by internal audit in ways that impair independence.
Master these points and you will be well prepared for any CRMA question on keeping the assurance map accurate, relevant, and useful to those charged with governance.
An assurance map is only as valuable as it is current. Organizations change constantly: new regulations arrive, business units are acquired or divested, systems are replaced, key risk owners leave, and the risk profile shifts with strategy and the external environment. An assurance map built once and left on a shelf quickly becomes misleading, giving the board and audit committee false comfort that risks are covered when they may not be, or hiding costly duplication among assurance providers.
For the CRMA exam, this topic sits within Domain I: Internal Audit Roles and Responsibilities Related to Risk Management. The exam tests whether you understand that internal audit's involvement with the assurance map is an ongoing, cyclical responsibility, not a one-time project, and that the chief audit executive (CAE) uses the map to coordinate with other providers, decide where reliance is appropriate, and shape a risk-based internal audit plan. It also connects directly to the IIA's requirements on coordination and reliance (Standard 2050 in the 2017 Standards and Standard 9.5 in the 2024 Global Internal Audit Standards) and to the Three Lines Model.
2. What Is an Assurance Map? (Quick Recap)
An assurance map is a structured document, often a matrix, that links the organization's key risks (rows) to the sources of assurance over those risks (columns). Sources of assurance typically include:
- First line: management and operational controls, self-assessments, supervisory reviews
- Second line: risk management, compliance, legal, quality, health and safety, information security functions
- Third line: internal audit
- External providers: external auditors, regulators, certification bodies, consultants
Each cell shows the type, extent, and sometimes the quality or rating of assurance provided. The map reveals gaps (risks with little or no assurance), overlaps (multiple providers covering the same ground), and over-reliance on a single, perhaps untested, source. The board and audit committee use it to form a holistic view of assurance; the CAE uses it to coordinate work, avoid duplication, and target scarce audit resources.
3. What Does Maintaining and Updating Mean?
Maintaining means keeping the map accurate and usable through disciplined ownership, version control, defined refresh cycles, and stakeholder validation. Updating means revising the content, the risks, the providers, the coverage, and the assessed reliability of assurance, whenever a trigger event occurs or on a scheduled cycle, so the map reflects current reality.
Key principles examiners expect you to know:
- The assurance map is a living document, aligned to the organization's risk universe and risk assessment cycle.
- Internal audit typically facilitates and coordinates the map; it does not own the risks or the first and second line assurance activities. Ownership of the risk framework stays with management; oversight stays with the board and audit committee.
- Updates must be evidence-based: changes to the map should follow from risk assessments, audit results, provider evaluations, and governance decisions, not from assumptions.
- Independence must be preserved. Internal audit can maintain the map as a coordination tool, but if it takes management responsibility for second line assurance activities, it must apply safeguards and disclose the impairment.
4. How It Works: The Update Cycle
Step 1: Establish governance and ownership. Define who owns the map (frequently the CAE as coordinator, with the audit committee as sponsor), who contributes (risk, compliance, management, external providers), how often it is refreshed, and how changes are approved and communicated. Document the methodology so updates are consistent over time.
Step 2: Monitor for triggers. Common events that require an update:
- Changes to the risk register or risk universe (new, emerging, or retired risks; changes in likelihood, impact, or risk appetite)
- Organizational change: mergers, acquisitions, divestitures, restructuring, new business lines, geographic expansion
- Regulatory and legal change creating new compliance obligations
- New systems, technology, or processes that change the control environment
- Changes in assurance providers: a compliance function is created, outsourced, downsized, or reorganized; a new external auditor is appointed; a certification lapses
- Results of assurance work: audits, external reviews, or incidents reveal that an assurance source is less reliable than assumed, or that a control area has deteriorated
- Board or audit committee requests for assurance on specific areas
- Scheduled refresh, usually at least annually, synchronized with the enterprise risk assessment and the internal audit planning cycle
Step 3: Reassess the risk dimension. Confirm the list of key risks is complete and current. Use the latest enterprise risk assessment, strategic plans, and discussions with senior management and the board. Remove obsolete risks, add emerging ones, and update ratings and risk owners.
Step 4: Reassess the assurance dimension. For each risk, identify who provides assurance now, what they actually do (scope, frequency, depth), and how reliable that assurance is. Evaluate providers for competence, objectivity, independence from the activity assessed, and due professional care, and consider whether their work is documented and can be tested. Reliability assessments often drive the color or rating assigned to each cell.
Step 5: Identify gaps, overlaps, and reliance decisions. Compare the updated coverage with the risk ratings and the board's assurance expectations. Highlight high risks with thin or untested assurance (gaps), areas where several providers do similar work (duplication), and areas where internal audit could rely on others to reduce its own effort. Reliance should be stronger where provider reliability is high and the risk is lower; direct internal audit testing should be prioritized where risk is high and other assurance is weak or unproven.
Step 6: Validate with stakeholders. Share draft changes with risk owners, second line functions, and senior management to confirm accuracy. Disagreements about coverage should be resolved through discussion and evidence, and material differences escalated.
Step 7: Report and act. Present the updated map, with the key changes, gaps, duplications, and recommendations, to senior management and the audit committee. Feed the results into the risk-based internal audit plan, coordination agreements with other providers, and management action plans to close gaps. Record the version, date, and approver.
Step 8: Embed continuous improvement. Capture lessons from each cycle, refine the methodology, and consider technology (GRC tools) to keep the map linked dynamically to the risk register and audit universe.
5. Internal Audit's Specific Responsibilities
- Coordinate with internal and external assurance providers to share information and minimize duplication.
- Evaluate reliability of other providers before placing reliance; the CAE remains accountable for conclusions drawn from relied-upon work.
- Align the audit plan to the map so that resources flow to high-risk, low-assurance areas and reliance is used where justified.
- Communicate the overall state of assurance and significant gaps to the board and audit committee.
- Preserve independence: facilitating the map is a consulting-type activity; internal audit should avoid owning or performing the second line assurance it later evaluates.
- Promote a common risk language so all providers classify risks consistently, which is essential for a map to stay coherent over time.
6. Common Pitfalls
- Treating the map as a one-off deliverable with no refresh cycle
- Updating risks but not the assurance providers, or vice versa
- Accepting assertions of coverage from providers without assessing scope or quality
- Inconsistent risk terminology across functions, making the map impossible to reconcile
- Failing to connect updates to the audit plan or to action plans for gaps
- Internal audit taking on management responsibility for filling gaps rather than recommending that management do so
- Not communicating changes to the audit committee, so governance decisions rest on stale information
7. Exam Tips: Answering Questions on Maintaining and Updating the Assurance Map
Tip 1: Look for the word that signals change. If a scenario mentions an acquisition, a new regulation, a new ERP system, a reorganized compliance team, or a shift in risk appetite, the expected answer almost always involves updating the assurance map and reassessing coverage before adjusting the audit plan.
Tip 2: Default to the facilitator role. When asked who should own, prepare, or update the map, remember that internal audit coordinates and facilitates, management owns the risks and controls, and the board or audit committee provides oversight and approves. Answers that have internal audit owning risks, designing second line controls, or performing management duties are usually wrong because they impair independence.
Tip 3: Frequency answers favor alignment, not fixed numbers. If options include a rigid interval versus alignment with the risk assessment cycle and significant changes, choose at least annually and whenever significant changes occur, aligned with the enterprise risk assessment and audit planning.
Tip 4: Reliance requires evaluation. Any option suggesting internal audit can rely on another provider simply because it appears on the map is a distractor. The correct answer includes assessing the provider's competence, objectivity, and the quality of work and recognizing that the CAE remains accountable.
Tip 5: Gaps go to management and the board. When the update reveals a high risk with little assurance, the best response is to report the gap to senior management and the audit committee and recommend how it should be addressed, and to consider adding the area to the audit plan, not for internal audit to quietly assume the assurance role itself.
Tip 6: Duplication is solved by coordination. If the scenario describes several functions reviewing the same area, the right action is coordination of scope and timing, information sharing, and possibly reliance, rather than internal audit unilaterally withdrawing or ignoring the overlap.
Tip 7: Sequence matters in process questions. Expect questions asking what to do first. The typical order is: identify the trigger or change, update the risks, update the assurance providers and their reliability, analyze gaps and overlaps, validate with stakeholders, report to governance, then revise the audit plan. Choosing revise the audit plan before reassess coverage is a common trap.
Tip 8: Remember the purpose. The ultimate goal is a holistic, current view of assurance that supports board oversight and efficient use of resources. When two answers both seem reasonable, pick the one that best serves that purpose and best fits the Three Lines Model.
Tip 9: Watch for independence red flags. Options that have internal audit monitoring and updating the map while also performing the second line compliance testing recorded on it without safeguards or disclosure are designed to test whether you recognize an impairment.
Tip 10: Use Standards language. Phrases like coordination and reliance, risk-based plan, communicate with the board, and evaluate the reliability of other assurance providers often mark the correct option. Vague answers about improving efficiency without reference to risk or governance are typically distractors.
8. Quick Revision Summary
- The assurance map is a living document linking key risks to assurance providers across all three lines and external sources.
- It must be maintained (governance, ownership, version control, validation) and updated (triggers and scheduled refresh) to remain reliable.
- Internal audit facilitates and coordinates; management owns risks and controls; the board oversees.
- Updates follow a cycle: trigger, reassess risks, reassess assurance and reliability, identify gaps and overlaps, validate, report, revise the audit plan.
- Reliance on others requires evaluation; the CAE stays accountable.
- Gaps and duplications are reported and coordinated, not absorbed by internal audit in ways that impair independence.
Master these points and you will be well prepared for any CRMA question on keeping the assurance map accurate, relevant, and useful to those charged with governance.
Test mode:
CRMA - Maintaining and Updating the Assurance Map Example Questions
Test your knowledge of Maintaining and Updating the Assurance Map
Question 1
While updating the organizationwide risk assurance map, the chief audit executive notes that third-party risk shows full coverage from three providers: the second-line compliance function, internal audit, and an external certification body. The work of each provider was previously evaluated as competent and objective. Two vendor failures this year arose from weak ongoing performance monitoring. Further review shows that all three providers test supplier onboarding due diligence. Which deficiency in how the map is maintained BEST explains why this gap went undetected?
Question 2
During the annual refresh of the organizationwide risk assurance map, the chief audit executive notes that most coverage entries came from assurance providers' own declarations. For one key risk, two second-line functions report full coverage. However, a recent internal audit of the same area found significant control gaps. The audit committee asks the chief audit executive how far it can rely on the map. Which conclusion is MOST appropriate?
Question 3
An organization's risk assurance map was last updated before it outsourced payroll processing and disbanded its second-line quality assurance team. The chief audit executive is helping management refresh the map before the next audit committee meeting. Which action is MOST appropriate?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Maintaining and Updating the Assurance Map questions
17 questions (total)
Other Internal Audit Roles and Responsibilities concepts
Advisory and Consulting Services on Risk ManagementAdvocating for Enterprise Risk ManagementAssessing Internal Audit Skill GapsAssurance Services on Risk ManagementBuilding an Organizationwide Risk Assurance MapChief Audit Executive Roles Beyond Internal AuditingChoosing Assurance or Advisory for a Risk RequestCombined AssuranceCompetencies for Risk Management AssuranceCoordinating Assurance Across ProvidersCore Internal Audit Roles in Enterprise Risk ManagementCo-Sourcing and Outsourcing Risk ExpertiseDeclining or Adjusting Work That Lacks CompetenceDeveloping Risk Management Competence in StaffEvaluating Reliance on Other Assurance ProvidersFinding Gaps and Overlaps with an Assurance MapFunctional and Administrative Reporting LinesImpairments from Risk Management ResponsibilitiesImproving Existing Risk Management ProcessesInternal Audit ERM Roles That Need SafeguardsInternal Audit's Role When No Risk Process ExistsOrganizational Independence of Internal AuditRecommending an Organizationwide Risk StrategyRelying on External Auditors and RegulatorsReporting Impairments to the Board and ManagementRoles Internal Audit Should Not Take in ERMSafeguards When Internal Audit Leads Risk WorkThe Three Lines ModelUsing External Experts in Risk Engagements