Internal Auditing and Organizational Governance: Combined Assurance Approach

Nowadays, an effective risk management is required for organizations to succeed and survive because strategy, risk, performance and sustainability are inseparable.

In this context, the ‘King Code of Governance Principles’ (King III) is probably the best governance model since it insists on two points: (1) the need for companies to have internal auditors who should take a risk-based approach in their work; and (2) an important part of the internal audit’s job should be dedicated to oversee a combined assurance model which is defined as “integrating and aligning assurance processes in a company to maximise risk and governance oversight and control efficiencies, and optimise overall assurance to the audit and risk committee, considering the company’s risk appetite” (The Institute of Internal Auditors, 2010).

Dealing with combined assurance have multiple potential benefits such as: (1) the focus of assurance providers is improved and more efficient; (2) assurance providers achieve a better consensus on the key risks through collaboration; (3) combined assurance reduces the likelihood of failure in identifying significant risk areas; (4) the embedded combined assurance model is coordinated to best optimise costs, avoid duplication and prevent assurance overloaded and it is the antidote to assessment fatigue which results from an uncoordinated assurance approach; and (5) combined assurance provides the audit committee with a much better basis for exercising its oversight role since the audit committee should be responsible for monitoring the appropriateness of the company’s combined assurance model and ensuring that significant risks facing the company are adequately addressed.

The research we intend to develop should determine how companies might benefit from implementing a combined assurance model. Since combined assurance is a new concept, we propose to conduct semi-structured interviews with several companies in order to go deeper into this concept and to determine: (1) do effective combined assurance models exist?; (2) determine the features of combined assurance for companies that have successfully implemented such a model; (3) draw up a list of guidelines or best practices for companies that have not already implemented such a model but who want to do it and (4) determine the benefits of combined assurance.