Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Sources of Assurance: Audit, Assessments and SOC Reports
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Sources of Assurance: Audit, Assessments and SOC Reports
How do we know it works?
A control on paper isn’t assurance. Assurance is evidence that controls actually work, and the board wants to know where that evidence comes from and how far to trust it.
Example. The board asks whether ransomware recovery is under control. IT says yes. Nobody independent has ever tested a restore. That’s an opinion, not assurance.
Who provides assurance
| Source | Examples | Independence |
|---|---|---|
| 1st line: management | Control self-assessment, supervisory reviews, restore tests | Lowest, but closest to the work |
| 2nd line: risk, compliance, security | Monitoring, key risk indicators (KRIs), compliance testing | Partial |
| 3rd line: internal audit | Independent audits | High |
| External | External audit, SOC reports, ISO certifications, regulators | Highest, but narrowest scope |
The more independent the source, the more weight its assurance carries. But independent sources look at fewer things, less often. A sensible approach combines them: management monitors continuously, the second line challenges, and audit and external parties confirm the most important controls.
Mapping assurance to risk
An assurance map (sometimes called combined assurance) lists the key risks and shows which sources give assurance over each one. Two problems stand out quickly:
- gaps: key risks with little or no independent assurance
- overlaps: risks tested by several functions in the same way, wasting effort and annoying the business
Before you rely on it
Before relying on another party’s assurance, check five things, shown in the diagram. Scope: does it cover the systems, locations and controls you care about? Period: is it recent, and does it cover the right time? Independence: who did the work, and could they be objective? Competence: did they have the right skills and methods? Findings: what exceptions were found, and were they fixed?
Reusing someone else’s work saves effort, but only if it covers your risk. Read the report, not just its conclusion.
SOC reports in brief
Service providers often give customers a System and Organization Controls (SOC) report from an independent auditor instead of allowing audits.
- SOC 1 covers controls relevant to customers’ financial reporting. SOC 2 covers security, availability, processing integrity, confidentiality and privacy.
- Type 1 says controls are suitably designed at a point in time. Type 2 says they were designed and operated effectively over a period, usually 6 to 12 months. For reliance over time, you want Type 2.
- A bridge letter covers the gap between the end of the report period and today.
- Complementary user entity controls are the controls the customer must run for the provider’s controls to work, such as reviewing its own users’ access.
- Carved-out sub-service providers (the provider’s own suppliers) aren’t covered and need separate assurance.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most independent assurance | Internal audit (internally) or an external auditor |
| Relying on a provider’s controls over time | A SOC 2 Type 2 report |
| FIRST check of a third-party report | That its scope covers your services |
| Finding gaps and overlaps in assurance | An assurance map |
| The report lists user entity controls | Make sure the organisation actually runs them |
In short
- Assurance is evidence that controls work. It comes from the first line (management), the second line (risk and compliance), the third line (internal audit) and external providers.
- The more independent the source, the more weight its assurance carries, but independent sources cover less ground.
- An assurance map shows which sources cover each key risk, revealing gaps and duplication.
- Before relying on another party's work, check scope, period, independence, competence and findings.
- For service providers, a SOC 2 Type 2 report gives assurance that controls operated over a period.
Exam traps
- Accepting a report's conclusion without checking that its scope covers your systems.
- Treating a SOC Type 1 report as proof controls operated over time.
- Ignoring the complementary user entity controls the report says you must run.
- Assuming a risk is covered because several functions mention it, when nobody actually tests it.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Turn your phone sideways for a bigger view. Tap any diagram to enlarge it.
Mapping assurance to risk
Before you rely on it