Register
Assurance Map Register
This register records, for each material risk, what assurance is in place and where the gaps are. It applies the three-lines model (and where adopted, the IIA's Three Lines Model 2020 update) by mapping risks against the activities of the first, second, and third lines of defence and against external assurance.
- Type
- Register
- Version
- 1.1.7
- Date
- 2026-09-25
- Owner
- Chief Risk Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Risk Management
- Review frequency
- Annual and upon material change to lines of defence, assurance providers, or risk methodology
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Section 1: lines of defence
- Section 2: register structure
- Section 3: domains the map covers
- Section 4: activity-type taxonomy
- Section 5: assurance rating scale
- Section 6: governance
- Section 7: integration with the assurance plan
- Section 8: gap management
- Worked example (illustrative; not a real entry)
- Operating expectations
- Framework alignment
- Limitations
Frameworks it maps to
- IIA Three Lines Model 2020
- ISO 31000:2018
- COSO ERM 2017
- COBIT 2019
- ISO/IEC 27001:2022
- ISO/IEC 42001:2023
- Basel Committee Operational Risk Principles
- FRC UK Corporate Governance Code
- OECD G20 Principles of Corporate Governance
Related documents
- Enterprise Governance and Risk Management Policyrisk
- Enterprise Risk Management Standardrisk
- Enterprise Risk Register Templaterisk
- Operational Risk Register Templaterisk
- Board Risk Report Templaterisk
- Continuous Assurance and Improvement Frameworkgovernance
- Role Authority Registergovernance
- Compliance, Audit, and CAPA Management Policycompliance
Next
All Documents