Combined Assurance Mapper
List the risks in your audit universe and record who gives assurance over each one, and how good it is. The tool shows where coverage is thin and where it is heavy, and drafts an audit plan from the days you have.
Before You Start
- Add each risk or auditable entity with its residual rating out of 25.
- Record every activity that gives comfort over it, not only internal audit: which line, and how strong.
- Set the audit days you have. The plan ranks the engagements and shares out the days.
- Produces
- A coverage map, the findings, a draft audit plan, a sample size and a CSV file.
New risk
Record every activity that gives comfort, not only internal audit. A supervisory review that actually happens is assurance. A policy that says it should is not.
Coverage Map
Sorted by residual rating. Each line shows the strongest assurance recorded on it.
Coverage is the weight of each line (first line 1, second line 2, third line 3, external 3) multiplied by the quality of the activity (limited 1, reasonable 2, strong 3), summed.
No risks mapped yet
Add the risks in your audit universe, or load the worked example, eight risks of a pension scheme, to see how the coverage map and the plan behave.
| Risk | Residual | First line | Second line | Third line | External | Coverage | Verdict | Actions |
|---|
A gap is a residual rating of 12 or more with coverage under 4. Over-assured is a rating of 8 or less with coverage of 12 or more.
Findings
How the coverage lines up against the risk.
Draft Audit Plan
Ranked by residual rating, raised where assurance is thin and where nobody has looked recently. Days are shared in proportion, from 8 to 30 for one engagement.
| Rank | Engagement | Residual | Coverage | Last audited | Priority | Days |
|---|
Sample Size
For testing a control by attributes. Sizes come from Poisson confidence factors, the basis of the attribute sampling tables auditors use.
Save This Map
Saving gives the map its own link to come back to. A coverage map helps justify an audit plan to a committee. Having it checked against the assurance actually performed is the work of a Pinebridge risk-based internal audit engagement.
- Saving sends this run and the details you give here to Pinebridge. Until then it stays in this browser.
- A saved run has its own link and a report set out for A4.
From A Coverage Map To An Audit Plan You Can Defend
A coverage map helps justify an audit plan to a committee. Having it checked against the assurance actually performed is the work of a Pinebridge risk-based internal audit engagement.