Assurance, Audit & Evidence

Overview

Evidence is only as good as its reader

Assurance goes wrong at the point where evidence is read. The monitoring runs, the audit is scheduled, the review takes place, and every one of them can be performed completely while confirming what everybody already believed.

The capability is in the sampling and the reporting: choosing a sample that could have failed, knowing what a piece of evidence can and cannot support, and writing a finding that costs somebody something rather than one that costs nobody anything.

Advisory

We support you in strengthening assurance and audit approaches that go beyond checklists, focusing on meaningful evidence, credible evaluation, and clear conclusions about the effectiveness of governance and operational measures.

The four phases below are the life of a management system, and an engagement can begin at any one of them.

1. 01

   Design

   Designing assurance and audit approaches

   –Define assurance scope, objectives, and principles

   –Establish audit frameworks, programmes, and methodologies

   –Design evidence models and evaluation criteria

   –Define roles, independence, and reporting lines

   –Integrate assurance into governance and management processes

2. 02

   Operate

   Executing audits and assurance reviews

   –Plan audits, scope engagements, and define sampling approaches

   –Conduct interviews, walkthroughs, and control testing

   –Collect and validate evidence

   –Document findings, ratings, and recommendations

   –Communicate results and support follow-up actions

3. 03

   Assure

   Assessing assurance systems and audit quality

   –Conduct independent reviews of assurance frameworks and audit programmes

   –Evaluate audit methodologies, sampling, and testing approaches

   –Assess evidence quality, sufficiency, and traceability

   –Review audit conclusions, ratings, and reporting consistency

   –Prepare assurance maturity assessments and improvement recommendations

4. 04

   Evolve

   Improving assurance systems and audit capabilities

   –Improve assurance frameworks and audit programmes continuously

   –Enhance audit methodologies and testing approaches

   –Integrate new requirements into assurance and audit practices

   –Develop audit capabilities, tools, and approaches

   –Provide executive sparring on assurance strategy and positioning

Audit

An audit of assurance tests whether the checking could fail: whether samples were capable of showing a problem, whether findings were reported at their real severity, and whether anything changed because of them.

Audits are organised by discipline rather than by capability domain, because the criteria they test against live in the standards.