GIA Cert Governance Foundations: Audit, Assurance and Performance Monitoring

Assurance landscape

Assurance gives confidence that controls and reporting are reliable. Sources include external audit (financial statements), internal audit (controls and risk), and specialist assurance (compliance, safety, quality). Independence and objectivity are essential.

Internal audit essentials

Internal audit provides independent, objective assurance and advice. It should report functionally to the audit committee and administratively to the CEO. Its plan should be risk-based, and it should follow up on findings. It should not design or operate controls it later audits.

External audit

External audit expresses an opinion on financial statements; auditor independence is supported by rotation, fee disclosure and restrictions on non-audit services. The audit committee oversees appointment and independence.

Performance monitoring

Boards monitor performance through KPIs, dashboards, board evaluation and management reporting. Good metrics are relevant, comparable and linked to strategy. Board evaluation should be regular, with follow-up actions.

Traps

• Confusing internal audit (controls/risk) with external audit (financial statements).
• Assuming audit provides absolute assurance; it provides reasonable assurance.
• Overlooking the need to track and close audit findings.
• Treating KPIs as static; they should evolve with strategy.

Worked example

Internal audit reports a control gap; management says it will fix it "when resources allow". What should happen? The gap should be tracked with an owner and deadline and escalated to the audit committee if overdue. Rule of thumb: findings without owners and dates are not remediation.

Governance in Practice: Policies, Processes and Reporting

From principles to practice

Governance works through documented policies, defined processes and reliable reporting. Candidates must know how a policy is created, approved, communicated, reviewed and retired.

Policy lifecycle

1. Identify need - driven by law, risk or strategy.
2. Draft - clear scope, responsibilities, definitions.
3. Approve - at the appropriate authority level (board or delegated executive).
4. Communicate and train - awareness is part of effectiveness.
5. Monitor and test - evidence of application.
6. Review and update - scheduled cycle or trigger events.

Processes and controls

Processes translate policy into repeatable steps; controls sit within them. Documentation should show ownership, approval, version control and review dates. Reporting closes the loop: board papers should be concise, balanced and decision-focused, with clear recommendations.

Reporting quality

Good governance reporting is timely, accurate, relevant and comparable. Dashboards should highlight exceptions and trends, not just activity. Minutes should record decisions and rationale, not just discussion.

Traps

• Assuming a policy exists means it is followed; monitoring and evidence are needed.
• Forgetting version control and review dates.
• Board packs that are long but lack clear decisions or recommendations.
• Minutes that omit the decision or the reasoning behind it.

Worked example

A whistleblowing policy was approved three years ago and never reviewed. What is the governance gap? Lack of scheduled review and monitoring evidence. Rule of thumb: every policy needs an owner, an approval record, a review date and evidence of application.