The Three Lines in Practice: Making Risk, Compliance, and Internal Audit Work Together
Article 6 closed with a one-page exercise: the assurance map, showing which of an organization’s principal risks carry continuous assurance, periodic assurance, or none at all. Boards that complete it honestly usually discover the same two things. First, some risks are assured twice — tested by internal audit, reviewed by compliance, monitored by risk...


