Access
Sign in by role
Choose your role. Each role sees its own areas of responsibility, the targeted risks it assures or oversees, and what is due from or to it.
OversightBoard
The Board and its Finance and Audit Committee.
- Assurance coverage of targeted risks
- Reports due to the Board
- Approvals due from the Board
First and second lineExecutives
Risk owners and second line oversight functions.
- Risks owned and controls
- Management actions due
- Assurance gaps raised
Third lineInternal Audit
Chief Audit Executive and the internal audit team.
- Planned engagements by risk
- Reliance on other providers
- Reports due to the Committee
Guest accessExternal Audit
The appointed external auditor, as a guest of the organisation.
- Risks relevant to the audit
- Reliance on internal audit work
- Information requested
Organisation accounts only. Access is restricted to members of the organisation (organisation accounts on your domain, illustrative); non-members are refused.
Signed in as
Board
Oversight of the combined assurance model, through the Finance and Audit Committee.
As at 20 Oct 2026. Illustrative.
Areas of responsibility
- Approve the Combined Assurance Policy and the risk appetite statement.
- Oversee assurance coverage of targeted risks, delegated to the Finance and Audit Committee.
- Receive the annual combined assurance statement and act on residual gaps.
Signed in as
Executives
First line risk owners and the second line functions that oversee them.
As at 20 Oct 2026. Illustrative.
Areas of responsibility
- Own the targeted risks and operate the key controls (first line).
- Provide risk, compliance and information security oversight (second line).
- Respond to assurance findings and close management actions on time.
Signed in as
Internal Audit
Independent assurance, coordination of the assurance map and reliance on other providers.
As at 20 Oct 2026. Illustrative.
Areas of responsibility
- Deliver the risk based internal audit plan and report to the Finance and Audit Committee.
- Maintain the assurance map (D4) and the risk assurance matrix (D5).
- Assess the basis for reliance on second line and external assurance.
Signed in as
External Audit
Read access to the risks relevant to the audit and to internal audit work available for reliance.
As at 20 Oct 2026. Illustrative.
Areas of responsibility
- Express the audit opinion on the annual financial statements.
- Coordinate with internal audit to avoid gaps and duplication.
- Report the audit plan, key audit matters and the management letter to the Committee.
Framework
COSO Internal Control (2013)
Internal Control: Integrated Framework (2013): five components and 17 principles. How each deliverable applies it.
Framework
ISO 31000:2018 Risk Management
Risk management guidelines: principles (clause 4), framework (clause 5) and process (clause 6). How each deliverable applies it.
Framework
King IV Corporate Governance
King IV Report on Corporate Governance (2016). Principle 15 covers assurance services and functions, including the combined assurance model. How each deliverable applies it.
Framework
IIA Three Lines Model and Global Internal Audit Standards
The IIA Three Lines Model (2020) and the Global Internal Audit Standards (2024). How each deliverable applies them.
Record
Feedback audit trail
Every review comment on a deliverable, the response, the change made and its status. Reviewers are shown by role.
Record
Board reporting schedule
Reports due to the Board and its Finance and Audit Committee. Select a report to see its purpose and contents.