Assurance

The Institute of Internal Auditors defines assurance as a statement intended to increase the level of stakeholders’ confidence about an organisation’s governance, risk management and control processes over an issue, condition, subject matter or activity under review, when compared to established criteria. The grammar is worth pausing on. Assurance is the statement. The work that produces it is an assurance service, and the two are separate definitions. The term is also newer than the profession most identified with it: assurance did not appear in the 2017 glossary at all and was added as a new term in 2024, so until then the standards defined assurance services, engagements and opinions but not the word the whole activity is named after.

Three conditions do the work in that definition. There must be established criteria, because a conclusion with nothing to compare against is an opinion rather than assurance. There must be a party other than the one responsible, which is the three-party relationship ISAE 3000 requires between a practitioner, a responsible party, and the intended users whose confidence is at stake. And there is a level. The Standards recognise limited and reasonable assurance depending on the nature, timing and extent of the procedures performed, so a claim to have assurance over something says very little until it says how much.

On a capital programme assurance is arranged rather than performed once. The Infrastructure and Projects Authority commissions independent reviews across a project’s life and sequences them to the decisions rather than to the calendar, running from strategic assessment through business justification and investment decision to readiness for service and benefits realisation. The sequencing is the point. Each review is timed to a decision somebody is about to take, which is the only timing at which assurance can still change the outcome.