What is a board assurance framework?

25 August 2016

We explain the purpose of board assurance and answer your core questions. Does your board understand and implement a risk management strategy?

The HM Treasury Guidance on Assurance Frameworks (2012) defines an assurance framework as: 'an assurance framework is a structured means of identifying and mapping the main sources of assurance in an organisation, and co-ordinating them to best effect'.

It could be argued that a BAF should represent the total arrangements in place for managing an academy’s assurances and not just an output produced for the board.

However, for the purposes of this toolkit we shall use the term ‘BAF’ to refer to the key document that is presented to a board and use the term ‘board assurance arrangements’ to refer to the wider mechanism for managing an academy’s assurances.

The development of board assurance arrangements should be a logical extension of an academy’s existing risk management arrangements. It is important therefore that you are satisfied with how your board and audit committee (or equivalent) understands and implements risk management, you maintain an informed engagement with the risks and opportunities that you face. If these arrangements are effective they will help you to understand the process and control environment, and help you answer the core questions:

  • what do we want assurance over?
  • how much assurance do we need?

Developing and maintaining board assurance arrangements is not, and should not be, a separate activity, but rather an embedded tool of management. As a natural extension of risk management, it would be reasonable to incorporate your board assurance policy and procedures into your risk management documentation, therefore ensuring that risk, control and assurance identification and monitoring processes are considered as a single, not disparate, set of activities.

What is meant by 'assurance'?

The word assurance is used a lot in everyday language and can mean different things to different people. It is important that everyone involved in developing, implementing and maintaining the BAF and arrangements are clear on what is meant by assurance for their own academy, and where assurances come from.

In order to frame the debate about assurance the question the board, audit committee and management should be asking themselves is: ‘Do we really know what we think we know?’

This reflective question should be seriously considered by the board given their responsibilities of planning, stewardship, performance and risk management.

Insight4GRC Insight4GRC


Insight4GRC™ is a cloud based GRC solution that provides management teams with the ability to efficiently manage risks and controls, track actions, communicate policies and procedures.