Audit and Assurance

This module draws a clear line between reassurance, which is a feeling, and assurance, which is evidence. It defines assurance, reassurance, control and oversight precisely, introduces the strength of evidence pyramid, six sources of assurance, the assurance question chain and four board postures on trust and evidence, and uses the Post Office Horizon scandal to show why no concerns raised is not the same as safety.

Everyone owns risk, and nobody marks their own homework. This module traces the three lines idea from the Institute of Internal Auditors' 2013 defence model to its 2020 Three Lines Model, walks through the diagram and its six principles, and explains why lines are roles rather than boxes. The collapse of Barings Bank shows what happens when doing and checking sit with one person.

A control that is never tested is a hope. This module explains the difference between control design and operation, COSO's five components of internal control, preventive and detective, manual and automated controls, and four key controls every board member should recognise. It covers culture as the control behind controls, the annual governance statement cycle, the new Provision 29 declaration, and the Carillion assurance gap.

Internal audit is the board's independent eyes. This module explains the Global Internal Audit Standards, their five domains and how they apply in the UK public sector from April 2025 alongside CIPFA's new local government code. It follows the internal audit year, shows through the Slough Borough Council case why an agreed action is not a completed one, and covers the warning signs for independence and how to read audit ratings.

The committee runs nothing, which is why it sees more. This module sets out the core functions of an audit committee from CIPFA's 2022 Position Statement, how committees are constituted across Welsh and English councils, the NHS, charities and housing, and how the committee works with auditors through the year. It explains the value of independent members, offers four questions for every meeting, and draws lessons from Croydon and Brick by Brick.

If you cannot draw your assurance, you do not have it. This module builds an assurance map in six steps, reads an illustrative housing association map, and sets out the four elements of a board assurance framework. It contrasts duplicated with missing assurance and compliance exercises with early warning systems, uses the fictional Tir Glas Housing to map building safety, and offers a matrix for matching assurance to risk.

Fraud is a risk to be managed, not a rare surprise. This module uses Donald Cressey's fraud triangle to explain why capable people cross the line, sets out four pieces of fraud law including the failure to prevent fraud offence and the Home Office's six principles of reasonable prevention procedures, and draws on the Covid Counter-Fraud Commissioner's findings and CIPFA's five principles to show why controls must be built in first.

A concern raised is free assurance. This module treats speaking up as part of the assurance system, covering whistleblowing law under the Public Interest Disclosure Act 1998, lessons from Mid Staffordshire and the Francis inquiry, the six parts of a speaking up system that works, and the unequal costs of speaking up. The Wirecard case shows why boards should treat the challenger as information, not as the enemy.

Every one of these failures had assurance on paper. This capstone module applies four lenses, evidence not reassurance, the lines and their independence, the committee and the map, and fraud and voice, to three real cases: Betsi Cadwaladr University Health Board, Thurrock Council and Kids Company. It draws out four common gaps and ends with four questions to take to your own board.