Integrated Assurance

Integrated assurance supports the Risk Management Framework by enabling the organisation to maximise the coverage of assurance in a coherent and coordinated manner, avoiding duplication and identifying gaps across control functions, based on the three lines model, and improving the understanding of accountability and responsibility for the assurance activities for all Council services.

Integrated assurance will establish the existence and resilience of the first, second and third lines of defence for the management of risks, delivery of Council Plan projects, delivery of service plan objectives and operational business for each area. It will assist managers to achieve embedded risk management by facilitating risk management, providing assurance on the effectiveness of their risk management arrangements wherever possible and making recommendations to optimise levels of control, taking advantage of opportunities and improving systems and processes.

The integrated risk management framework, through a common language and coordinated reporting, will develop a concise and focused message to the governing body (Senior Leadership Team / Audit Committee) and help to identify and eliminate gaps in coverage of risk and controls.

An assurance mapping exercise will identify the sources of assurance within the three lines model and the strength of assurance offered by these sources. It will incorporate the key risks and Council projects managed by each service.

Assurance mapping is a structured means of identifying and mapping, in a visual chart or table, the main sources and types of assurance in an organisation, and the relevant evidence for that assurance. An organisational assurance map can assist in identifying any gaps in sources of assurance or any areas of concern, such as duplicated or potentially burdensome assurance processes, and hence where the attention should be focused.

The mapping will initially be driven by the structures adopted for individual organisational risk registers, and will include strategic risks, significant operational risks, key processes and significant change programmes.

In addition, assurances will be sought from the first line roles (Managers) through biannual self-assessments of the governance, risk management and internal control environment.