Most organisations can describe their governance structure. They can explain how risks are managed, who receives reports, which committees provide oversight and which policies govern operations but many organisations that appear well governed on paper still experience serious failures.
Why? Because an assurance framework is often confused with an assurance process.
Having governance structures does not automatically create assurance, it simply creates opportunities for assurance.
An effective assurance framework is not one that produces the most reports, it is one that consistently helps leaders understand reality well enough to make good decisions.
Assurance is about confidence …. but confidence in what?
When boards receive assurance, they are often seeking confidence that risks are being managed. The danger is that confidence can gradually become detached from operational reality.
If assurance relies solely on audits, dashboards, compliance returns and performance indicators, leaders may gain confidence that systems are functioning exactly as intended. What they may not understand is whether those systems are functioning in practice.
The purpose of assurance should therefore be broader than confirming compliance.
It should answer questions such as:
Good assurance increases understanding, not simply confidence.
One of the central themes within The Compliance Illusion™ is that organisations rarely fail because assurance activities are absent, they fail because those activities create confidence without necessarily creating understanding. The gap between those two things is where governance risk often develops.
What is assurance?
Assurance is the process of providing leaders with sufficient confidence that significant risks are understood, controls are effective and organisational objectives are likely to be achieved.
Genuine assurance goes a step further. It doesn't simply ask whether systems exist; it seeks evidence that they are operating as intended in practice.
The Characteristics of an Effective Assurance Framework
1. It starts with organisational objectives
Every assurance activity should ultimately support something important.
So often assurance becomes a collection of disconnected audits because no one asks, what are we trying to assure ourselves about?
Effective frameworks align every assurance activity with organisational objectives.
2. It combines multiple sources of evidence
One report rarely tells the whole story. Strong assurance frameworks deliberately combine:
The aim is triangulation. When different sources tell the same story, confidence increases and when they conflict, curiosity should increase.
3. It tests reality
This is often the missing ingredient; Policies tell us what should happen and reality tells us what does happen.
An effective framework deliberately tests whether documented processes are actually working operationally. Examples include:
Reality testing prevents organisations becoming over-reliant on paperwork.
4. It values weak signals
Major failures are rarely without warning; Small concerns often appear months or even years, before significant events. These might include:
Individually these may appear insignificant but collectively they often reveal emerging organisational risk. Effective assurance frameworks pay attention before problems become visible in KPIs.
5. It encourages challenge
Healthy assurance includes constructive scepticism. Questions like:
Challenge should never be viewed as criticism, as it is one of governance's most valuable disciplines.
6. It makes psychological safety part of assurance
Information only flows when people believe it is safe to share.
If staff fear blame, managers fear looking incompetent, executives fear asking difficult questions, assurance quality deteriorates rapidly.
Psychological safety is therefore not simply a culture initiative, it is an assurance requirement. Organisations cannot understand reality if people are unwilling to describe it.
7. It focuses on learning rather than proving success
Some assurance processes unintentionally become exercises in demonstrating compliance. The emphasis shifts from ‘help us understand’ to ‘help us look compliant.’
The most effective frameworks create an environment where discovering problems is considered success, not failure because unidentified risk is always more dangerous than identified risk.
A Practical Assurance Health Check - Ask yourself these ten questions:
A framework that struggles to answer several of these questions positively may be providing oversight but not necessarily understanding.
Introducing the Assurance Triangle™
One of the practical models I use during Executive Assurance Reviews is the Assurance Triangle™. It encourages leaders to consider assurance from three complementary perspectives rather than relying on compliance evidence alone.
1. Compliance
Are we doing what we said we would do? Examples:
2. Reality
Is this how work actually happens? Examples:
3. Confidence
How certain are we that our conclusions are correct? Consider:
If any side of the triangle is weak, assurance becomes less reliable; Compliance without reality creates false confidence, reality without verification creates unreliable evidence and confidence without challenge creates complacency.
The Five Questions Every Board Should Ask
Whenever assurance is presented, ask:
These questions often generate richer discussions than another page of dashboard metrics.
Final Thought
An effective assurance framework is not measured by the volume of reports produced, the number of audits completed or the sophistication of its governance structure, it is measured by one outcome: Does it help leaders understand reality well enough to make better decisions?
When assurance becomes an exercise in confirming what we already believe, it loses its value but when it encourages curiosity, challenges assumptions, tests operational reality and gives decision makers a clearer picture of how the organisation is truly functioning, it becomes one of the most powerful tools in governance.
Governance isn't strengthened by producing more assurance, it's strengthened by improving the quality of organisational understanding. That is where effective assurance frameworks make the difference and it is where The Compliance Illusion™ begins.
An independent assurance, governance and risk adviser, keynote speaker and the creator of The Compliance Illusion™.
