Maintain an assurance map: reveal gaps and avoid false coverage
An assurance map connects significant risks with who examines them, what was covered, when, and with what limitations. Keep scope and evidence visible so a checkmark does not imply complete assurance. Refresh the map when risks, providers, systems, or the relevance of prior work change.
Hypothetical teaching data, not industry statistics
| Risk | Compliance | Internal audit | Next decision |
|---|---|---|---|
| Access removal | Policy design only | No current test | Operating gap |
| Vendor changes | No coverage | Current operation tested | Review exceptions |
| Incident response | Prior system only | Planned, not performed | Refresh coverage |
“Planned” is not performed coverage. “Policy design” is not operating effectiveness. Use scope and period before deciding whether a risk is adequately covered.
A useful coverage cell needs context
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Risk and objective | Describe the exposure being addressed, such as unauthorized access. | Using a broad department name that hides different risks. |
| Provider and work | Identify the provider, period, method, and whether work assesses design or operation. | Treating policy review and operating tests as equivalent coverage. |
| Gap and update | Record exclusions, stale evidence, and the next response. | Leaving an old green cell unchanged after a system replacement. |
Risk and objective
Describe the exposure being addressed, such as unauthorized access.
Avoid: Using a broad department name that hides different risks.
Provider and work
Identify the provider, period, method, and whether work assesses design or operation.
Avoid: Treating policy review and operating tests as equivalent coverage.
Gap and update
Record exclusions, stale evidence, and the next response.
Avoid: Leaving an old green cell unchanged after a system replacement.
A decision path you can use
- 1Map risks to actual assurance work
- 2Check scope, timing, and reliance
- 3Update gaps and inform the audit plan
Understand the method
Work through the reasoning
Map assurance to risks and objectives
An assurance map records which providers perform relevant work over important risks or objectives. It should identify the scope, period, nature of work, and significant limitations. A cell containing a provider’s name does not establish that the risk is adequately covered.
Use a structure that reflects the organization’s actual assurance questions. Mapping only by department can miss risks that cross functions or systems. Distinguish management monitoring from independent assurance so the map does not imply that every marked cell provides the same kind of confidence.
Qualify coverage before relying on a colored cell
Assess whether the recorded work is relevant, current, and suitable for its intended use. The coordination lesson explains evaluation of provider competence, objectivity, and work quality. The map should retain enough reference information to connect its coverage indicator to that evaluation.
Differentiate planned, performed, and evaluated work. A scheduled review does not provide completed assurance. A report covering design may not establish operating effectiveness, and work over one application may not cover the entire business process. Make these distinctions visible in the map’s definitions.
Update the map when coverage assumptions change
Significant events can make a map stale before its next routine review. System migrations, acquisitions, new products, provider scope changes, and emerging risks may alter coverage. Define responsibility for updating entries and a process for identifying these triggers.
Preserve review dates and evidence references. If a provider’s work has not been reassessed since a major process change, flag the uncertainty rather than leaving the cell green. A current map should show what is known, what is planned, and what remains unassessed.
Use gaps and overlaps to inform planning
A gap can prompt additional work, coordination, or a documented decision about coverage. An overlap can be useful if providers address different objectives or assurance needs. Evaluate the substance before removing work merely because two names appear in the same row.
Feed the map into risk-based planning and oversight communication. Explain the significance of uncovered areas and the options for addressing them. The map supports judgment; it does not mechanically determine the audit plan or transfer accountability for internal audit’s conclusions.
Original teaching example
Apply the method to a decision
The scenario
The matrix marks access control fully covered because compliance reviewed the access policy. No provider tested whether departed employees lost access in the current system.
The decision
Show policy-design coverage separately and retain the operating-effectiveness gap.
A matrix summarizes evidence; it cannot create evidence. A new operating test, coordinated work, or a plan change may address the gap. The provider’s name and a green cell are not substitutes for a matched objective and period.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A green cell survives a major migration
The situation
The map shows customer-access risk as covered by a security review. That review addressed the retired platform, and no work has evaluated the replacement.
Reason through it
The coverage indicator is stale. Identify which conclusions remain relevant, update the entry, and assess the new assurance need in planning.
Take the decision
Maintain coverage based on current evidence and scope, not the continued existence of a past report.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Does overlap between providers always mean wasted work?
No. Different mandates, periods, objectives, or depths may justify overlapping subjects. Examine the actual work before deciding whether to coordinate, rely, supplement, or retain separate procedures.
How often should an assurance map be updated?
Use a defined review process and update when significant events change risks or coverage assumptions. A fixed annual refresh alone may leave the map misleading after a migration, acquisition, or provider scope change.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Internal Audit Plan (15% of Part 3). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 9.4-9.5. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
- IIA Three Lines Model: 2026 Statement of Position
- The internal audit function’s role as the integrator of assurance, page 19. Provides context for coordinated assurance coverage. Our matrix is a simplified teaching example, not an IIA-mandated template or evidence that the depicted risks are adequately covered.
Part 3: Internal Audit Function. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.