The Assurance Map: Who Is Checking What, Across Three Lines

An assurance map is a grid. One axis lists the institution's work, here nine processes. The other lists who could confirm that it is done properly, here the three lines. Each cell records what assurance exists there. An empty cell is a place nobody is looking and nobody has noticed that nobody is looking. So the map is read for its empty cells rather than its full ones.

The whole subject follows from one inversion, so the inversion is worth stating before anything else. A control report asks what was tested and what the testing found. Nearly every document an institution produces asks some version of that question: here is the work that was done, here is what it showed. An assurance map asks the opposite question, and almost nothing else inside an institution ever asks it. Where is nothing being tested at all? The question is unusually hard to answer. An absence produces no paperwork of its own. A test that ran leaves a report, a finding, a paper for a committee and a line in somebody's plan. A test that never existed leaves silence, and silence looks exactly like everything being fine. The only way to see an absence is to draw every place assurance could exist and then look at what is blank.

There is a version of this that lands before any of the institutional version arrives. Three people share a flat. Each of them, going to bed, has a vague sense that somebody checks the back gate on the way through. Nobody has ever said who. On most nights at least one of them wanders past the gate, so for eleven months the arrangement works perfectly well. On the night the arrangement does not work there is no argument about whose job the gate was. It was never anybody's job. No record exists of a decision to leave the gate unchecked either, and no decision was ever taken. The flat is the shape of the subject, at a scale of three people. A bank with 214 key controls has the same shape at a very different scale.

What question does an assurance map exist to answer?

An assurance mapA grid showing what confirmation exists over each part of an institution and, more usefully, where none exists at all. exists to make an absence visible, and that is a strange purpose for a document, so it is worth being precise about why it needs a purpose-built instrument at all. Every other way of looking at control in an institution starts from something that happened. A finding starts from a test. An incident starts from a loss. A committee paper starts from work somebody did. Each of those is a lamp, and each of them lights the place it is pointed at. None of them lights the places nobody pointed anything at. Nothing in those places is generating any noise, so no natural pressure inside an institution pushes anybody to go and look at them.

So the map is drawn from the other end. Instead of collecting the assurance that exists and describing it, the complete set of places where assurance could sensibly exist is drawn out first, and only then is what is actually there written in. Drawing the empty grid first is the whole trick. A grid drawn from the work that was done can never contain a blank. A picture built by listing the reviews that happened has something in every square by construction, and the finished article is a catalogue of effort rather than a map of coverage. A picture built by listing the places first produces its blanks on its own, and nobody has to be clever enough to spot them.

The distinction sounds procedural and it is actually the difference between an instrument that works and one that cannot. Vindhya Commercial Bank Limited, an invented bank, has nine processes and three lines, so it has twenty seven places where assurance could sit. The bank writes the twenty seven squares first. Two of them turn out to be blank. Had it instead asked its risk function, its compliance function and its internal audit function to describe their coverage, it would have received three confident and accurate descriptions, all three of which would have been about work that had been done, and the two blanks would have appeared in none of them.

Why does one axis list processes rather than departments or risks?

The choice of axes is the only real design decision in the whole instrument, and getting it wrong quietly destroys what the instrument was built for. One axis has to describe the institution's work. There are three obvious candidates and only one of them works: departments, risks or processes. Vindhya Commercial Bank Limited lists nine processesA named stretch of work with a start, an end and somebody accountable for it, here numbered PR1 to PR9., numbered PR1 to PR9: PR1 account opening and customer onboarding, PR2 lending and disbursal, PR3 collateral management and valuation, PR4 payments and settlement, PR5 trade finance, PR6 treasury dealing and settlement, PR7 deposit servicing, PR8 financial reporting and close, and PR9 access management and information security.

Departments fail first, and they fail for an interesting reason. A department is an arrangement of people, and an institution rearranges its people roughly every few years without any of the work changing. More seriously, work crosses departments and failure runs along the work. Trade finance at this bank touches a front office that agrees the deal, an operations team that checks the documents and a technology team that runs the system the documents arrive in. A map drawn by department gives three rows, each of them partly covered, and no row anywhere in which the absence of anybody looking at the thing end to end would show. The failures that matter most live in the gaps between departments, and a map by department hides exactly those.

Risks fail second, and more subtly. A risk taxonomy is a fine thing and this bank has one, but a risk is a category rather than a stretch of work, so a cell on a risk axis has no owner and no start and no end. A process can be assured because somebody performs it, on particular days, leaving particular evidence. A category cannot be assured. A process, by contrast, has all three things that make assurance possible: a beginning, an ending, and a person who has to answer for what happens between them. The axis is processes for that reason, and the nine listed are the bank's own list rather than a standard one, so a different bank would draw different rows.

Who are the three lines, and whose model is that?

The other axis lists who could confirm that the work is being done properly, and here the answer is borrowed wholesale from somebody else. The three lines model belongs to the Institute of Internal Auditors, and the Institute restated it in 2020. The model divides the people who can say something about a control into three, and the division is by what they are, not by how senior they are or how clever they are.

The first line is the business itself, the people who take the risk and run the work. At Vindhya Commercial Bank Limited the first line is the people inside PR1 to PR9 who operate the 214 key controls day by day. The second lineRisk and compliance, who set the policies and the limits and challenge the business, here under Sunanda Ravikumar. is risk and compliance. Risk and compliance sets the policies PL1 to PL9 and the limits, and challenges the way the first line runs. At this bank it sits under Sunanda Ravikumar, the chief risk officer. The third lineInternal audit, independent of both the business and the risk function, here under Rustom Batliwala and reporting to committee G3. is internal audit, under Rustom Batliwala. Internal audit tests both of the others and reports outside management to committee G3, the audit committee.

The three lines work as an axis because assurance from one line is not a substitute for assurance from another, even over exactly the same process. The three lines are not three degrees of thoroughness on one scale. Each line stands in a different relationship to the work, and each can see something the other two structurally cannot. The first line knows what actually happens on a Tuesday afternoon and can never be detached from it. The second line understands what the policy intended and sits inside the management chain that the policy binds. The third line is independent of both and, precisely because of that, arrives least often and knows the least about the detail. A cell filled by the first line alone and a cell filled by all three are not the same cell with different amounts of ink in it.

What has to be written in a cell before that cell counts as filled?

A cellOne process against one line, holding whatever assurance that line provides over that process. is one process against one line, and the whole map is only as honest as the rule applied when deciding whether a cell has something in it. Most maps go soft at exactly this point. The person filling a cell in is usually the person whose work is being described, and a generous rule makes their row look better. So the rule has to be written down before anybody starts filling anything, and it has to be a rule about evidence rather than about effort.

Four things, and a cell that is missing any one of them is a claim of coverage rather than coverage. Who performed the work, named, and which line they sit in. The evidence they actually saw, kept, and able to be produced again. The period the work speaks for. A review of one month is not a statement about a year. And how recently it was done, the part everybody forgets and the only one of the four that changes on its own. Recency is what quietly turns a full cell back into an empty one. Nobody has to do anything wrong for work performed four years ago to stop being a description of what happens now.

The everyday version is a rented flat and its electrical wiring. Somebody did check it. There is a certificate, there is a name on it, and it covered the whole flat rather than one socket. Three of the four parts are present and the cell looks full. The certificate is from 2009. Nothing has gone wrong, nobody lied, and the honest entry is not that the wiring was checked; the honest entry is that the wiring was checked a very long time ago and that this is now closer to a blank than to a confirmation. An assurance map that carries no date in its cells is a map of the past pretending to be a map of the present.

Why do the convincing substitutes fill a cell so easily?

Because every one of them is a real thing that somebody worked hard on, and because the person filling in the map is rarely trying to mislead anybody. A policy is a genuine artefact with an owner and an approval date. A system control that blocks a bad entry is often stronger than any human check. A monthly report to a committee is real information travelling to real decision makers. An attestation is a person putting their name to something. Nobody writing any of those into a square is being dishonest. Each of them answers a slightly different question from the one the map asked, and the map does not shout when that happens.

The test that separates them takes one sentence: assurance is somebody confirming, on evidence they kept, that the thing actually happened. Run each substitute past it. A policy says what ought to happen, so it fails on the word happened. An untested system control is a design that would work. A design is a statement about the future rather than a confirmation about the past. A management report describes outputs and nobody has checked that the process behind the outputs ran as intended. An attestation with nothing behind it fails on the word evidence, and it is the most dangerous of the four because it is the one that uses the language of assurance while carrying none of the substance.

Why is a cell with all three lines in it a problem rather than a comfort?

A finished map is read twice, in two opposite directions, and most people only ever do the first reading. The first reading looks for duplicated assuranceTwo or more lines testing the same thing, which costs twice and can leave each of them assuming the other went deeper., meaning places where more than one line is confirming the same thing. The second reading looks for absence. The two readings sound like opposite findings and they usually have one cause. Nobody sat down and decided how much confirmation each part of the work needed.

Vindhya Commercial Bank Limited summarised the depth of its own map like this: 6 of the cells carry assurance from all three lines, 14 from two, 5 from one and 2 from none at all, and 6 plus 14 plus 5 plus 2 is 27. Take the 6 first. Three separate confirmations of the same work costs three budgets, three lots of the business answering the same questions, and three sets of papers. Three budgets are the visible cost and the smaller one. The larger cost is that each of the three can quietly assume that one of the others went deeper, so three shallow reviews can be mistaken for one thorough one, and nobody has to be careless for that to happen.

The same thing happens in a household. Three siblings each check that an elderly parent has taken the morning tablets. Each of them, knowing the others are around, asks a slightly gentler question than they would ask if they were the only one. Three checks have happened. Something less than one proper check has happened. The count of checks is not the amount of checking. Counting filled squares is exactly the trap a map invites.

How is a cell found that nobody ever decided to leave empty?

The second reading is the one the instrument exists for, and it is mechanical rather than clever. The reading goes row by row, and in each row the three lines are asked separately: is there an entry here that carries all four parts? Not is this area important, not does anybody worry about it, and certainly not does anybody feel comfortable. Just is there an entry. An uncovered cellA place on the map where a line provides no assurance over a process, usually because nobody ever decided that it should. announces itself the moment the question is asked in that form, and it is invisible under any softer question.

The reason the softer questions fail explains why these gaps survive for years inside serious institutions. Asked what it covers, a second line function gives a truthful list of what it covers. Asked what it does not cover, it gives a thoughtful answer about what it has decided not to prioritise. The answer names a completely different set, the things that were considered and set aside. The cells that hurt are in neither list. Nobody ever considered those cells at all, so they sit on neither the coverage list nor the deprioritised list. A gap that was decided is a judgement somebody can defend, and a gap that was never noticed is not a judgement at all. So the map has to be built from the grid rather than from anybody's plan.

At this bank the second line built its plan the way most plans get built. Last year's plan was the starting point and it was adjusted. The second line had historically worked in the processes where it had always worked, and two processes had simply never been on the list. No paper anywhere in the record says that assurance over those two was considered and declined, because nothing was ever considered and nothing was ever declined. A thin cell and a blank one differ in exactly that way, and the second reading of the map is built to expose the difference.

What did this bank's map find, and what landed in the two blank cells?

Vindhya Commercial Bank Limited drew its map across nine processes PR1 to PR9 on one axis and the three lines on the other, giving 9 times 3, being 27 cells. Two of the 27 carried no assurance at all. The two empty ones were second line assurance over PR5, trade finance, and second line assurance over PR3, collateral management and valuation. Nobody had decided to leave them empty and there is no paper in the record saying otherwise, for the reason set out above: the second line plan grew out of where the second line had historically worked, and those two processes had never been on it.

Now put the year's loss record beside the map. The map stops being an administrative exercise at that moment. Across the twelve numbered months the bank booked Rs 43.8 crore of net operational loss over thirteen incidents numbered I1 to I13. Incident I13 is the trade finance fraud, in which a trade finance officer and an external party issued 9 letters of credit against forged shipping documents over fourteen months ending in month 8, and it cost Rs 15.4 crore net. Incident I13 is the largest net loss of the year, and it sits in PR5. Incident I10 is the stale collateral valuation feed. The feed ran for 11 working days in month 10 and left 340 loans wrongly marked with no monitoring control detecting it, and it cost Rs 1.4 crore net. The feed sits in PR3, and it is the incident behind the year's one material weakness. Together those two incidents account for Rs 16.8 crore of the year's Rs 43.8 crore, being 38.4 per cent, and both of them landed in the only two cells on the map where nobody from the second line was looking.

Be precise about the second one, because the money misleads. Rs 1.4 crore is the tenth largest net loss of the thirteen, so incident I10 is nothing much as a loss. Incident I10 is heavy because of where it went: a wrong collateral mark feeds a provision, and a provision feeds a reported number, and that is why it became the one finding rated D4 in the year. The two blank cells therefore produced the year's largest loss and the year's one material weakness. Largest loss and material weakness are two different kinds of seriousness, and neither of them is simply a rupee ranking.

One discipline has to travel with that finding. Without the discipline the finding becomes an overclaim. The map was drawn before either incident was discovered, and that is the only sense in which it predicted them. The map did not say a fraud was running in trade finance. The map said that if something went wrong in trade finance, no part of the second line was positioned to notice. The two statements are different, and the honest one is the weaker one. The map records where nobody was looking, and it never records that somebody looking would have found anything. A trade finance fraud that ran for fourteen months might have survived a second line review perfectly well, and the record says nothing either way.

One more habit is worth having. The case is full of numbers that repeat themselves with different meanings, and merging any pair of them ruins a paragraph. At this bank 27 means two things: the 27 cells of the grid, and Rs 27.0 crore. The Rs 27.0 crore is what remains of the year's Rs 43.8 crore of net operational loss once the Rs 16.8 crore in the two blank cells is taken out. The number 9 means six different things in this bank: the nine processes PR1 to PR9, the nine policies PL1 to PL9, the 9 letters of credit inside incident I13, the 9 hours a vendor payment gateway was down in incident I9, the 9 issues in ageing bucket AG5, and the 9 of the 42 control findings that carry no stated cause. And 42 itself means four things here: the 42 control findings, the Rs 42.0 crore gross loss of incident I2, the 42 issues older than 90 days, and the 42 of 147 risk data elements carrying all eight attributes T1 to T8. Naming the object every time keeps any two of them from colliding.

Who is the map actually for, and why does it go to committee G3?

A map that nobody with money can act on is internal literature and nothing more. At Vindhya Commercial Bank Limited the map goes to committee G3, the audit committee, which has four members, all of them independent directors, and which also receives the control findings, the issue ageing and the internal financial controls assessment. The destination is not an administrative detail; it is what makes the instrument work at all. The map has to be read by the people who would have to explain a blank cell, not by the people who fill the cells in.

Think about who could actually close one of those two gaps. The second line would have to put a process on its plan that has never been on it. Doing so means finding people, budget and time, all of them currently committed elsewhere. A function does not make that decision about itself easily, and the ordinary pressure runs the other way. Every cell already on the plan has a constituency and a blank cell has nobody. A committee outside the management chain is the only reader who can look at a blank square and ask for it to be filled without also having to explain what will be dropped to pay for it.

The second thing G3 supplies is memory. A gap of this kind survives by being nobody's item, and a committee that saw the same two blank cells last time and sees them again this time is the only mechanism in the institution that makes an absence accumulate weight. Neither of those functions requires the committee to know anything about trade finance. Both jobs require it to read a grid and ask, twice, why two squares are still empty.

What can an assurance map never show?

One thing, and it is large enough that stating it is part of using the instrument honestly. CoverageWhether assurance exists in a cell at all, which is a completely different question from whether it was any good. is whether assurance exists in a cell. Quality is whether it was any good. The map answers the first question completely and the second one not at all. Coverage and quality need different evidence, so no improvement to the grid can make it answer both. A grid can record that internal audit reviewed a process and issued a report. The grid cannot record that the review was thorough, that the sample was large enough to have found anything, that the person doing it understood the work, or that the conclusion followed from what was actually looked at.

A shallow review fills a cell exactly as convincingly as a deep one. So the map is a first question and never a last one. The limit is not a flaw to be fixed by adding columns. Depth, sample size, competence and how recently the work was done are properties of the assurance, and they belong in the entry rather than in the shape of the grid. The four parts of an entry exist for precisely that reason: they force the smallest useful amount of quality information into a square that would otherwise say only that something happened.

So the sequence for anybody reading a finished map runs in one direction and it is worth memorising. First, which squares are blank. Second, of the squares that are full, which of them carry a date old enough that the entry has quietly expired. Third, of what remains, what evidence is actually named. A reader who starts at the third question on a map with two blank squares has spent the meeting on the strongest part of the picture.

How does somebody outside a bank ever use an idea like this?

Four kinds of reader use the shape of an assurance map, and only one of them works inside a risk function. A credit officer at a lending institution, assessing a borrower, is trying to work out how much confidence to place in numbers the borrower produced about itself, and the useful question is never how many controls the borrower has. The useful question is which parts of the borrower nobody independent has looked at, and whether the parts that decide the numbers are among them. An equity analyst asks the same question with a different motive and adds one of their own: what changed since last year. A new blank square is news in a way a long standing one is not.

A diligence team looking at an acquisition reads it hardest, because they are about to inherit both the numbers and whatever was or was not checking them. And a household reads a version of it too, without ever calling it that. Anybody who has ever asked whether the bills are on automatic payment, on somebody's memory, or on nobody at all has drawn a two column assurance map and read it for the blanks. The instrument is not sophisticated. The hard part is the discipline of writing out every square before filling any of them in. The blank square is the one nobody will volunteer.

One habit is worth carrying into any work of this kind. When a picture of coverage arrives, the first question is not what is in it. The first question is how the picture was built. If it was built by asking people what they cover, it is a picture of effort and it cannot contain a gap. If it was built by drawing the whole grid first and then filling it in, it is a map, and its blanks mean something.