What is Board assurance?

The evidence-based confidence a Board has that material risks are understood, owned and controlled, and that the position reported to it is supported by evidence rather than activity alone.

What should a Board assurance report include?

Typically the material-risk position, accountable owners, control effectiveness, assurance coverage and gaps, unresolved findings, remediation progress, accepted residual risk and the decisions required. Content should be proportionate to the organisation.

What is the difference between management reporting and independent assurance?

Management reporting organises and communicates information. Independent assurance evaluates whether that information and its underlying evidence support sufficient confidence in the position. They are related but not interchangeable.

What is a governance maturity assessment?

A diagnostic review of how effectively accountability, controls, reporting and evidence operate in practice, used to identify priority improvements. It is not a universal score without an agreed methodology.

How do you assess whether controls are effective?

By confirming the control is designed to address the risk, that it operates as documented, and that evidence supports that conclusion — through review, walkthrough, sampling or testing proportionate to materiality.

What is an assurance map?

A view of where confidence in material risks comes from — management, oversight functions, independent assurance and external evidence — showing duplication and important gaps.

Can IG-Smart help prepare for an internal or external audit?

Yes. IG-Smart can assess readiness, clarify ownership, strengthen evidence and close known gaps before formal review, while the audit itself remains with the relevant auditor.

Can IG-Smart work alongside Internal Audit?

Yes. IG-Smart can complement Internal Audit with specialist governance assessment or assurance mapping, with roles agreed so work is not duplicated. Internal-audit outsourcing is only provided where expressly contracted.

Does IG-Smart provide statutory audit?

No. IG-Smart does not provide statutory or financial-statement audit or audit opinions. It provides independent governance assessment, readiness and assurance support, and can work alongside your auditors.

How does regulatory assurance differ from legal advice?

Regulatory assurance strengthens the evidence, accountability and controls behind your position. It does not provide a legal opinion; where legal interpretation is needed, it should come from qualified legal advisers.

Can IG-Smart improve an existing Board pack?

Yes. The aim is not reformatting but improving the quality of assurance reaching decision-makers — clearer materiality, ownership, evidence, findings and decisions required.

Can the engagement cover privacy, cyber, AI and supplier risks together?

Yes. IG-Smart can bring these domains into one organisational assurance view so the Board can see how the risks interact, drawing on specialist input where needed.

Independent Assurance & Board Reporting

Board-Ready Governance Assurance and Organisational Resilience

Q: What is governance assurance?

The structured use of assessment, evidence, monitoring and independent challenge to determine whether accountability, risk management, controls and oversight are operating as intended — giving leadership a clearer basis for defensible decisions.

Turn complex governance, risk and control information into evidence your Board can understand, challenge and act on.

Talk to a Senior PractitionerStill defining the requirement

Submit a RequirementDefined scope, tender or RFP

IG-Smart helps regulated and high-consequence organisations assess governance effectiveness, strengthen accountability, prepare for audit or regulatory scrutiny and give Boards a clearer view of material risk, controls, remediation and residual exposure.

Our work connects assessment, evidence, independent challenge and reporting — so assurance supports decisions rather than becoming another layer of administration.

Hover, focus or select a step to see what it draws on and what it informs.

Conceptual view of how evidence becomes an accountable board decision — not a prescribed methodology.

Independent Assessment
Board-Level Assurance
Audit Readiness
Regulatory Assurance
Residual-Risk Visibility

When organisations engage us

Board visibility is fragmented
Committees receive reports, but material risks, control effectiveness and residual exposure remain difficult to see.
Audit or regulatory scrutiny is approaching
Evidence, ownership and control gaps need to be understood before formal review.
Findings keep recurring
Remediation addresses symptoms without resolving the governance cause.
Regulation is changing
Leadership needs to understand how new requirements affect accountability, controls and evidence.
Growth has outpaced governance
Existing arrangements no longer match organisational scale, complexity or risk.
A major transformation is underway
Technology, operating-model, supplier or organisational change has altered the assurance position.
Independent challenge is required
Management needs a view beyond self-assessment.
Investors need portfolio visibility
Governance and risk need to be assessed consistently across multiple businesses.

What we help solve

More reporting does not automatically create more assurance

Most organisations already have plenty of governance material:

Risk registers
Compliance reports
Policies
Dashboards
Audit findings
Committee papers
Remediation trackers
Management attestations
Technical assessments

Yet leadership can still struggle to answer basic Board questions:

Which risks actually matter?
Who is accountable?
Which controls are material?
Are those controls operating effectively?
What evidence supports that conclusion?
Which findings remain unresolved?
Is remediation on track?
What residual risk remains?
Who has accepted that risk?
What does the Board need to decide?

The underlying issue

The problem is often not lack of information. It is lack of a coherent assurance position.

A Board pack becomes more valuable when evidence, control effectiveness, unresolved findings and residual risk can be traced to clear ownership and decisions.

What the engagement involves

Strengthen governance from assessment through Board assurance

01
Board Assurance
Help Boards understand material risk, controls, evidence, findings and residual exposure in a decision-ready format.
02
Governance Maturity Assessment
Assess how effectively accountability, controls, reporting and governance evidence operate and identify priority improvements.
03
IG-Smart Resilience Index
Benchmark whether governance arrangements can withstand scrutiny, disruption, audit, regulatory pressure or supplier failure.
04
Governance Operating Model Design
Define practical roles, decision rights, committees, escalation, assurance responsibilities and accountability.
05
Audit Readiness Assessment
Identify weak evidence, ownership gaps and control issues before formal audit or assurance activity exposes them.
06
Regulatory Assurance
Strengthen the evidence, accountability and control position required to respond credibly to regulatory scrutiny.
07
Board Reporting & Assurance Packs
Turn complex governance, risk and assurance information into concise dashboards, scorecards, action trackers and decision-ready Board packs.
08
Private Equity Portfolio Governance
Give investors and portfolio leaders clearer visibility of governance, privacy, cyber, AI, supplier and resilience risk across portfolio companies.

Talk to a Senior Practitioner

Definition

What is governance assurance?

Governance assurance is the structured use of assessment, evidence, monitoring and independent challenge to determine whether accountability, risk management, controls and oversight are operating as intended. It gives Boards and accountable executives a clearer basis for understanding material risks, evaluating remediation and making defensible decisions.

Governance

Who decides and who is accountable?

roles
decision rights
committees
escalation
ownership

Risk & Control

What could prevent the organisation achieving its objectives and what manages that exposure?

risks
controls
owners
tolerance
treatment

Assurance

What evidence supports confidence in the position?

assessment
monitoring
testing
review
independent challenge

Board Reporting

What does leadership need to understand and decide?

material issues
trends
findings
remediation
residual risk
decisions

Strong governance connects all four.

Board line of sight

From organisational risk to Board decision

A Board should be able to follow the line from the risk being managed to the evidence supporting the assurance conclusion.

Assurance is strongest when management evidence, control effectiveness, independent challenge, findings and residual risk can be traced to the decision the Board is being asked to make.

01Strategic objective
02Material risk
03Accountable owner
04Material controls
05Evidence / assurance
06Findings & remediation
07Residual risk
08Board decision / risk acceptance

Executive assurance

What should the Board be able to see?

Material risks
What exposures could materially affect objectives, obligations or critical services?
Accountability
Who owns each material risk and control?
Material controls
Which controls matter most to the position being assured?
Control effectiveness
What evidence shows those controls are operating as intended?
Assurance coverage
Where does confidence come from — and where are the gaps?
Findings
Which weaknesses remain unresolved?
Remediation
Are actions progressing at the required pace?
Residual risk
What remains exposed and who has accepted it?

Decision-ready assurance tells the Board what the position means, not merely what activity occurred.

Reporting and assurance

Board reporting and Board assurance are related — but not the same

Reporting

Organises and communicates relevant information. May include:

KPIs / KRIs
Risk movement
Incidents
Findings
Action status
Compliance activity

Assurance

Evaluates whether the information and underlying evidence support sufficient confidence in the position. May include:

Independent assessment
Control testing
Evidence review
Gap analysis
Challenge
Residual-risk evaluation

The strongest Board packs bring reporting and assurance together without pretending they are interchangeable.

Assurance map

Where should assurance come from?

01
Management evidence
- control ownership
- monitoring
- attestations
- metrics
02
Risk / compliance / governance oversight
- challenge
- monitoring
- review
- policy oversight
03
Independent assurance
- internal audit
- independent assessment
- specialist testing
- external review
04
External evidence
- certification
- regulator feedback
- customer assurance
- supplier evidence

Board / Audit & Risk Committee

Decision
Remediation
Risk acceptance
Further assurance

The purpose is not to maximise assurance activity. It is to understand whether material risks have sufficient and proportionate assurance. Not every organisation needs every source.

Organisational resilience

Governance should withstand more than routine operations

Organisational resilience is reflected in the ability to maintain effective decision-making, accountability and critical obligations during:

Regulatory scrutiny
Incidents
Supplier failure
Cyber disruption
Executive turnover
Rapid growth
Acquisition / restructuring
Audit
Material control failure
Major regulatory change

Resilience is not simply business continuity. It includes the governance capability to make accountable decisions when normal assumptions stop holding.

01Understand
02Prepare
03Withstand
04Respond
05Recover
06Learn

Governance maturity

Governance maturity is visible in behaviour, not document volume

01
Reactive
Governance responds mainly when problems arise.
02
Defined
Key roles, policies and processes exist.
03
Operating
Governance arrangements are embedded in routine activity.
04
Assured
Evidence demonstrates whether controls and governance are functioning.
05
Adaptive
Governance changes as risks, regulation, technology and business models evolve.

Increasing maturity

The maturity model is used diagnostically, not as a universal scoring claim. Scores are only produced against an agreed assessment methodology.

Audit readiness

Audit readiness starts before the evidence request

Recurring audit difficulty often results from:

Unclear ownership
Evidence assembled too late
Controls documented differently from how they operate
Previous findings not fully closed
Inconsistent risk acceptance
Weak decision records
Remediation trackers without accountable owners
No clear evidence trail

Audit readiness should strengthen the underlying governance position rather than simply prepare documents for an auditor.

Regulatory assurance

Regulatory scrutiny tests evidence as well as intention

Organisations may need to demonstrate:

Accountable ownership
Appropriate governance structures
Control effectiveness
Evidence of monitoring
Documented decisions
Remediation
Escalation
Risk acceptance
Board oversight

Applicable requirements depend on sector, organisation and regulatory perimeter. IG-Smart does not apply one generic framework to every client.

Reference points

Current UK governance expectations

UK Corporate Governance Code 2024 and Provision 29

The UK Corporate Governance Code 2024 applies to companies listed in the FCA commercial companies category or closed-ended investment funds category. The Code applies for financial years beginning on or after 1 January 2025, with Provision 29 applying from 1 January 2026.

Provision 29 requires the Board to monitor the company's risk-management and internal-control framework and review its effectiveness at least annually. The Board's annual-report declaration relates to controls it determines to be material, including relevant financial, operational, reporting and compliance controls.

Read the full position

What constitutes a material control is company-specific. The FRC does not prescribe a universal list, and the degree of additional assurance required is a matter for the individual Board to determine.
Governance consultancy is distinct from statutory audit.

FRC: UK Corporate Governance Code (opens in a new tab)FRC: Corporate Governance Code Guidance (opens in a new tab)

Large private-company governance

Large private companies within scope of the Companies (Miscellaneous Reporting) Regulations 2018 must disclose their corporate-governance arrangements. The Wates Principles provide one recognised framework that eligible companies may use for that purpose; they are not universally applicable or mandatory as the only governance framework.

FRC: Wates Principles (opens in a new tab)

Good-governance guidance, statutory obligations and sector regulatory requirements are different things. Which apply depends on the organisation, its sector and its contractual and investor commitments.

Cross-domain assurance

Board assurance increasingly crosses traditional governance silos

The Board does not experience these risks as separate website service pages. Assurance should show how they interact at organisational level.

Specialist depth is available through Fractional & Outsourced DPO Services, Information Governance Consultancy, Cyber Governance & Assurance, AI Governance & Assurance and NHS & HealthTech Assurance.

Data Privacy
Information Governance
Cyber Security
AI Governance
HealthTech / Clinical Safety
Supplier Risk
Operational Resilience
Regulatory Compliance

Portfolio governance

Portfolio governance needs comparable evidence without forcing every company into the same model

The objective is a comparable assurance view while preserving the context of each portfolio company.

Investors may need visibility across:

Governance maturity
Cyber
Privacy
AI
Supplier risk
Regulatory exposure
Management actions
Residual risk

How we deliver

How IG-Smart approaches a governance assurance engagement

01
Assess
Establish the governance context, material risks, accountability, controls, evidence, assurance coverage, findings and decision needs.
02
Build
Define governance structures, control ownership, assurance methods, reporting, escalation and evidence requirements.
03
Manage
Support the governance rhythm — risk reviews, action tracking, assurance coordination, committee reporting and remediation oversight.
04
Assure
Independently assess whether governance arrangements, controls and evidence support the conclusions being reported to leadership.
05
Improve
Close findings, strengthen maturity, update evidence and adapt governance as risks, regulation and organisational priorities change.

Improvement feeds the next assessment cycle, keeping the assurance position current rather than recreating it for every audit, Board cycle or regulatory review.

Sample outputs

What a governance assurance engagement may produce

Representative reports, registers and records, so you can picture the output before you engage.

Illustrative structure — not a client document. Examples show the type, format and level of detail clients may receive. Exact outputs depend on the agreed scope.

Illustrative output