Skip to main content
Governance Authority
Category: Internal Audit and Assurance

Compliance Assurance Mapping

Also known as: Assurance Mapping, Assurance Map
Simply put

Compliance assurance mapping is the practice of laying out, usually in a single document or visual chart, all the different ways an organization gets assurance that its key risks are being managed. It shows which risks are covered, who is responsible for each assurance activity, and where gaps or overlaps may exist. The result helps boards, committees, and management see whether their risks are adequately covered without duplicated effort.

Formal definition

Assurance mapping is a structured method for identifying, cataloguing, and aligning the sources and types of assurance across an organization, commonly organized against the lines of defence model and tied to the enterprise-wide risk assessment or corporate risk register. The map documents which functions provide assurance over specified risks, the nature and reliability of that assurance, and the responsible parties, thereby exposing coverage gaps, overlaps, and reliance points. In internal audit contexts it is typically a supplemental tool to the risk assessment and audit plan, and it may also support evaluation of a quality assurance and improvement program (QAIP). The precise scope, terminology (for example, three versus four lines of defence), and governance ownership vary by organization, framework, and jurisdiction, and the map's usefulness depends on the accuracy of the underlying risk assessment. This entry is educational and does not constitute legal, audit, or compliance advice.

Why it matters

Boards and their audit or risk committees are generally responsible for satisfying themselves that an organization's key risks are being managed, yet in practice assurance over those risks is often fragmented across many functions, internal audit, compliance, risk management, external audit, regulators, and specialist reviews. Without a consolidated view, oversight bodies can struggle to tell whether a significant risk is covered by robust, independent assurance, covered several times over by duplicated effort, or not meaningfully covered at all. Compliance assurance mapping addresses this by drawing the disparate sources of assurance together, typically against the lines of defence model, so that coverage gaps, overlaps, and points of reliance become visible.

The value of an assurance map lies in supporting more informed judgment rather than in generating certainty. Overlapping assurance activities can waste resources and impose duplicative demands on the business, while gaps can leave a risk exposed with no one testing whether controls are actually working. A map that ties assurance sources to the enterprise-wide risk assessment or corporate risk register helps management and the board direct assurance effort to where risk is greatest and to weigh how much reliance can reasonably be placed on each source.

It is important to recognize the limits of the tool. An assurance map is only as reliable as the underlying risk assessment; if a risk is missing or mis-rated in the risk register, the map will faithfully reproduce that blind spot. The map also records who provides assurance and its nature, but it does not itself evaluate the operating effectiveness of controls. This entry is educational and does not constitute legal, audit, or compliance advice; the appropriate scope, terminology, and ownership will depend on the organization, framework, and jurisdiction.

Who it's relevant to

Boards and audit or risk committees
These oversight bodies use an assurance map to gain a consolidated view of how the organization's key risks are being assured, helping them judge whether coverage is adequate and whether reliance on particular assurance sources is warranted. The map supports their oversight role but does not discharge it, and its usefulness depends on the accuracy of the underlying risk assessment.
Chief audit executives and internal auditors
For internal audit, the map is typically a supplemental input to the risk assessment and audit plan, helping direct audit effort toward gaps and away from areas already covered by reliable assurance. It can also support evaluation of a quality assurance and improvement program (QAIP) and conformance with applicable professional Standards.
Chief risk and compliance officers
Risk and compliance functions often coordinate or contribute to assurance mapping, aligning assurance activities against the corporate risk register, clarifying who is responsible for each activity, and identifying overlaps that duplicate effort or gaps that leave risks untested. Ownership of the exercise varies by organization.
Management and control owners across the lines of defence
Operational management and functional specialists appear on the map as providers of assurance and, in the first and second lines, as those managing and monitoring controls. The map helps them see how their activities fit within the broader assurance landscape, though it records the nature of assurance rather than evaluating control operating effectiveness itself.

Inside Compliance Assurance Mapping

Obligation Inventory
A structured catalogue of the compliance obligations to which an entity is subject, typically spanning binding law (statutes, regulations, listing rules) and, where relevant, voluntary standards or codes the entity has chosen to adopt. The inventory generally identifies the source, applicability by jurisdiction and business line, and the internal owner accountable for each obligation.
Control Linkage
The connection between each obligation and the controls intended to address it. Mapping typically distinguishes control design (whether a control is capable of meeting the obligation) from operating effectiveness (whether it functions as intended over time), and records who owns and operates each control within management (the first line).
Assurance Source Allocation
The identification of which function provides assurance over each obligation and control, commonly organized using a three-lines model: management as the first line owning and operating controls, compliance and risk functions as the second line providing oversight and monitoring, and internal audit as an independent third line. The map makes explicit which activity each line performs to avoid conflating monitoring with independent assurance.
Coverage and Gap Analysis
An assessment of where obligations are well covered, where assurance is duplicated across lines, and where gaps exist. This element supports rationalization of effort and helps the board and its committees understand residual exposure after controls and assurance are considered.
Reporting and Escalation Routes
The pathways by which results of monitoring and assurance are reported to management, relevant board committees (such as audit or risk committees), and the board. The map generally clarifies oversight responsibilities without transferring operational duties to the board.

Common questions

Answers to the questions practitioners most commonly ask about Compliance Assurance Mapping.

Is compliance assurance mapping the same as building a risk register?
No. A risk register typically catalogues risks along with attributes such as likelihood, impact, and ownership, and it is generally a risk management artifact. Compliance assurance mapping, by contrast, focuses on connecting obligations, controls, and the assurance activities that test whether those controls operate as intended. The two are complementary and often reference one another, but they answer different questions: a register asks 'what could go wrong and how significant is it?' while an assurance map asks 'which controls address this obligation, and who provides assurance over them, and how confident can we be?' Treating them as interchangeable can leave gaps where a risk is recorded but no assurance activity is mapped to it.
Does a compliance assurance map prove that controls are effective?
Not on its own. A map is a structural tool that shows how obligations, controls, and assurance sources relate to one another; it can reveal where assurance exists, is duplicated, or is missing. Whether a control is actually effective is a separate question that depends on both control design and operating effectiveness, which are typically established through testing, monitoring, or independent assurance work rather than through the map itself. A well-constructed map can highlight where evidence of effectiveness is thin, but the map documents coverage, not conclusions about how well controls perform in practice.
How does assurance mapping relate to the three lines model?
Assurance mapping is often used to make the three lines model concrete for a given set of obligations. In many organizations, first line management owns and operates controls, a second line compliance or risk function monitors and provides oversight, and a third line internal audit function provides independent assurance. A map can identify which line is providing assurance over each obligation or control, helping surface areas of over-reliance on a single line or gaps where no line is engaged. The specific allocation of activities across the lines varies by entity type, sector, and how each organization has defined its functions, so the map should reflect the organization's own structure rather than an assumed standard.
Where should an organization begin when developing an assurance map?
A common starting point is to define the scope and the source obligations, distinguishing binding legal requirements from voluntary standards or internal policies, since these may carry different priorities and different consequences. From there, organizations typically inventory the relevant controls, then identify the assurance activities associated with each. Beginning with the highest-priority obligations, however those are defined against the organization's risk appetite, generally allows the exercise to deliver value before it is fully comprehensive. The appropriate starting scope depends on the organization's size, sector, regulatory environment, and available resources, so this is a matter for professional judgment rather than a fixed sequence.
Who should own and maintain the assurance map?
Ownership arrangements vary by organization. In many structures a second line compliance or risk function coordinates the map because it sits across obligations and monitoring activity, while first line management remains accountable for the underlying controls and assurance providers remain responsible for their own work. Boards and their committees, such as an audit or risk committee, typically use the map for oversight rather than maintaining it themselves. Clear ownership matters because a map that no one keeps current tends to drift out of alignment with actual controls and obligations. The specific allocation should be set to fit the organization's governance structure and documented so responsibilities are unambiguous.
How often should an assurance map be updated?
There is no single required frequency; the appropriate cadence generally depends on how quickly the underlying obligations, business activities, and controls change. Organizations often review maps on a periodic cycle and also update them when triggered by events such as regulatory change, a significant business or structural change, or findings from assurance activity that reveal a gap. In fast-moving regulatory environments more frequent review may be warranted. Because this depends on facts specific to the entity, the sensible approach is to define review triggers and a baseline cycle appropriate to the organization rather than to apply a fixed interval.

Common misconceptions

A completed compliance assurance map guarantees the organization is compliant.
A map is a planning and coordination tool that shows how obligations are intended to be covered and assured; it does not itself demonstrate that controls operate effectively or that obligations are met. Actual compliance depends on control operating effectiveness, the quality of monitoring, and the facts of each situation, which must be tested and evidenced separately.
Assurance mapping is an internal audit responsibility, so audit owns the underlying controls.
The controls are typically owned and operated by management (the first line). Second-line compliance and risk functions provide oversight and monitoring, while internal audit provides independent assurance. Mapping should preserve these distinct roles rather than attribute operational control ownership to assurance functions.
One framework or standard makes assurance mapping a mandatory, uniform exercise across all organizations.
Frameworks such as three-lines models and enterprise risk management or governance codes offer guidance rather than a single universal legal mandate. Whether and how mapping is performed varies by jurisdiction, sector, entity type, and applicable binding requirements versus voluntary standards.

Best practices

Begin with a defensible obligation inventory that separates binding legal requirements from voluntarily adopted standards, and record applicability by jurisdiction and business line.
Assign a clear owner to each obligation and control within management, and separately identify which line provides monitoring versus independent assurance so accountability is unambiguous.
Distinguish control design from operating effectiveness in the map, and treat coverage as provisional until effectiveness is actually tested and evidenced.
Use the map to identify both gaps and duplicated assurance across the three lines, then rationalize effort while preserving the independence of internal audit.
Define reporting and escalation routes to the appropriate board committees, keeping the board in an oversight role rather than assigning it operational tasks.
Review and refresh the map on a defined cycle and in response to changes in law, business activities, or risk profile, treating it as a living tool rather than a one-time deliverable.