RISK MANAGEMENT MODULE: RISK ASSURANCE
Risk assurance is a vital process that ensures an organization’s risk management strategies and internal
controls are working effectively. This module introduces the concept, importance, key sources, tools, and
applications of risk assurance in strengthening organizational governance and decision-making.
LEARNING OBJECTIVES
At the end of this module, students should be able to:
1. Define risk assurance and understand its purpose.
2. Identify the main sources of risk assurance in an organization.
3. Describe key tools and frameworks used in assurance.
4. Analyze real-world applications of risk assurance.
5. Apply the concept through practical exercises.
A. What is Risk Assurance?
Risk assurance provides independent validation that an organization’s risk management practices are
effective and aligned with strategic goals. It builds stakeholder confidence by confirming that risks are
monitored and controls are functioning (IRM, 2022).
B. Key Sources of Risk Assurance
1. Management (1st Line): Ensures controls are built into day-to-day operations.
2. Risk and Compliance Teams (2nd Line): Monitor adherence to policies and risk frameworks.
3. Internal Audit (3rd Line): Independently evaluates controls and reports to senior leadership.
4. External Providers: Auditors, regulators, and certifying bodies give external assurance.
*These layers form the "Three Lines Model" (IIA, 2020), a widely used framework to deliver effective
risk oversight.
C. Tools and Frameworks in Risk Assurance
1. Assurance Mapping
Assurance mapping is a strategic tool that helps an organization visually identify and align all sources of
assurance over its key risks and controls.
Purpose and Use:
It answers the question: “Who is providing assurance over which risk or control, and how often?”
By mapping these sources, organizations can:
Avoid duplication of assurance efforts
Identify gaps where no assurance is being provided
Clarify roles across the Three Lines (Management, Risk/Compliance, and Internal Audit)
Improve reporting to senior management and the board
Example: An assurance map might show that internal audit reviews financial reporting controls annually, while
compliance reviews them quarterly, and external auditors review them annually—providing complete visibility
on assurance frequency and coverage.
2. COSO ERM Framework (Enterprise Risk Management)
The Committee of Sponsoring Organizations (COSO) ERM Framework is a globally recognized model for
designing, implementing, and integrating risk management with strategy and performance.
COSO emphasizes continuous monitoring and assurance as integral to achieving organizational objectives. It
promotes:
Embedding risk assessment and response within strategic decision-making
Aligning assurance activities with performance metrics
Enabling board and management oversight through clear assurance roles
Key Components Relevant to Assurance:
Monitoring activities (Ongoing or separate evaluations of internal controls)
Information and communication (Providing reliable data for assurance)
Risk governance and oversight (Structures that define assurance roles)
Example: Using COSO, a company ensures that risks tied to strategic objectives (e.g., market expansion) are
tracked and assured through regular reports from both compliance officers and internal auditors.
3. Internal Audit Programs
Internal audit programs consist of structured, independent assessments conducted by internal audit teams to
verify the adequacy, efficiency, and effectiveness of internal controls and risk responses.
Purpose and Role in Risk Assurance:
Provide objective assurance to management and the board
Evaluate whether controls are functioning as intended
Identify inefficiencies, non-compliance, or emerging risks
Offer recommendations for improvement
Core Activities Include:
Planning audits based on a risk-based audit plan
Testing internal control procedures
Verifying compliance with laws, policies, and standards
Reporting findings to the audit committee or senior executives
Example: An internal audit of procurement practices may uncover that vendor selection controls are being
bypassed, which could expose the company to fraud risk—prompting management to improve oversight.
4. Risk and Control Self-Assessments (RCSAs)
RCSAs are tools that allow individual departments or process owners to identify, assess, and evaluate their own
risks and controls regularly.
Role in Risk Assurance:
Encourages ownership of risk at the operational level
Provides first-hand insight into control effectiveness
Enables early detection of issues before audits
Supports a culture of continuous improvement and risk awareness
Typical RCSA Process:
1. Identify key risks in the process or area
2. Rate the likelihood and impact
3. Assess the design and effectiveness of controls
4. Document gaps and suggest mitigation actions
Example: The IT department performs a quarterly RCSA to assess data security risks. They discover an
outdated firewall policy and take immediate action before any breach occurs—this proactive check enhances
assurance.
D. ACTIVITIES
Assurance Mapping: Create a risk assurance map for a university or small business. (100pts)
Content 40pts, Originality of Output, 40pts, Referencing 15pts, Format 5pts.
Mini Case Analysis: Evaluate a real-world company failure linked to weak risk assurance (e.g., Boeing 737
Max).
Essay (in a 1 whole sheet of yellow pad paper)
How does risk assurance strengthen an organization’s reputation and governance? (Adopt an organization
you know and apply the question)
*Not less than 200 words.
Scoring Rubrics:
Content 60pts, Grammar 20pts, Neatness of Work 10pts, Originality of Thoughts 10pts
E. REFERENCES
Institute of Risk Management. (2022). Risk Assurance Guide. https://www.theirm.org
Institute of Internal Auditors. (2020). The IIA’s Three Lines Model. https://www.theiia.org
COSO. (2017). Enterprise Risk Management: Integrating with Strategy and Performance.
Fraser, J., Simkins, B., & Narvaez, K. (2021). Implementing ERM (2nd ed.). Wiley.
