Combined Assurance - Case Studies on a Holistic Approach...

Combined Assurance – Case Studies on a Holistic Approach to Organizational Governance (Gerrit Sarens, Loïc Decaux, and Rainer Lenz)

In the current economic situation, organizations are trying to reestablish trust with their stakeholders. Stakeholders have forced boards of directors to take on increasing governance responsibilities in order to avoid new catastrophic events. 

Although organizations have recovered (or are trying to recover) from the crises that have occurred, boards and management must demonstrate their commitment to manage significant risks. One reason for the recent crises is that boards were blamed for not having performed their oversight role appropriately. 

In this context, a holistic approach to risk management and assurance activities is required. That is why the King Code of Corporate Governance in South Africa—King III—has called for better governance mechanisms and has introduced the concept of combined assurance, which coordinates assurance activities between various assurance providers, as a leading and recommended practice. 

Today, the risks that can negatively impact organizations are so diverse that the internal audit function cannot provide absolute assurance on its own; it has to coordinate with other assurance providers. Nevertheless, assurance providers have performed their activities in silos, leading organizations to various inefficiencies in their risk management and assurance activities as well as a lack of consistency and transparency. In practice, combined assurance initiatives are still rare.

This research is based on six multinational organizations that are in different development stages when it comes to combined assurance. The purpose of this research is to increase awareness about combined assurance. Starting by defining combined assurance and identifying reasons for having implemented combined assurance, the research follows with an assessment of the benefits, barriers, and challenges in implementing the framework. It is shown that fragmented risk and assurance functions lead to inefficiencies and inconsistencies that ultimately affect board and senior management who, in turn, have difficulties understanding the global picture regarding their risk exposure. The research continues by addressing the key steps and critical success factors for a successful combined assurance implementation. Finally, the research states that the role of the internal audit function is critical in the combined assurance framework, and the report discusses further challenges and adjustments that internal audit function should deal with to take the lead in the combined assurance process.

As a result, combined assurance can be seen as a road to good overall organizational governance in the eyes of stakeholders and their representatives. Moreover, it could well become the standard strategy for successful and effective internal audit function.