Skip to main content

Governance, Risk & Assurance

Governance Assurance & Board Reporting

Independent assurance for Boards and senior leadership — so the position reported to the Board is supported by evidence rather than activity alone, and every material exposure has an owner and a decision.
What the Board needs to know
  1. What do we actually know?
  2. How reliable is the evidence?
  3. Where are we exposed?
  4. What requires management action?
  5. What requires a Board decision?
  6. Who owns the action?
  7. How do we know the position is improving?

  • 18+ yearsSenior practitioner experience

  • Independent assuranceNever over work IG-Smart managed or delivered

  • Published enterprise evidenceA FTSE 100 company · AIG

  • ISO/IEC 27001:2022Certified information-security management

IG-Smart does not stop at findings. It converts evidence into decision-quality assurance: what the Board can rely on, where it is exposed, and what it must decide.

Senior-led and coordinated by a named service team, shown below.

  1. Trigger
  2. Independent view
  3. Evidence reliability
  4. Exposure
  5. Decision
  6. Accountability
  7. Monitored action
  8. Assurance

Board assurance view

One page the Board can act on

The shape of the view we build with leadership. An illustrative structure, shaped to your agreed scope.
What we know
Area A: supported
Evidence reliability: Tested
Position supported by examined evidence within scope.
Where confidence is lower
Area B: partly supported
Evidence reliability: Reviewed
Evidence examined and challenged; effectiveness not yet tested.
Where we are exposed
Area C: unverified
Evidence reliability: Asserted
Position currently rests on an owner statement.
Decisions required
Accept, direct or escalate
Each material exposure framed as a decision, with the evidence behind it.
Owner and revisit
Named owner · next review date
Every action has an accountable owner and a point at which the position is re-examined.

Evidence reliability

Tested
Evidence independently examined, or control operation tested, within the agreed scope.
The Board can place the most weight on this position.
Reviewed
Evidence examined and challenged, but control effectiveness not independently tested.
Credible, but confidence depends on the evidence remaining current.
Asserted
The position relies mainly on a management or owner statement.
Treat as unverified until evidence is examined.

Describes how each conclusion was reached within the agreed scope. It is not a statutory or financial-statement audit opinion.

Assurance topography

Every domain connects to an accountable decision

Select a domain to see what the Board needs to see from it.

Governance

Whether accountability, decision rights and oversight operate as documented.

Privacy

Material personal-data risk, DPIA outcomes and incidents needing Board attention.

Cyber

Control effectiveness and residual security exposure, in decision-ready terms.

AI

Where AI is used, who owns it and which risks have been accepted.

Data

Whether data and records are governed consistently across teams and systems.

Regulation

The evidence behind the organisation’s regulatory position.

People

Ownership, capability and accountability for material controls.

Suppliers

Third-party exposure, assurance coverage and unresolved findings.

Evidence to decision

From evidence to a monitored Board decision

  1. Evidence

    Gathered and tested proportionate to materiality.

    Owner: Control owners

  2. Finding

    What the evidence does, and does not, support.

    Owner: IG-Smart

  3. Risk

    Exposure rated against agreed appetite.

    Owner: Risk owner

  4. Management response

    Action, owner and date — or a reasoned acceptance.

    Owner: Management

  5. Board decision

    Accept, direct or escalate, on the record.

    Owner: Board

  6. Monitored action

    Progress tracked and re-examined until closed, so the Board can see whether the position is improving.

    Owner: Management, with assurance

When Boards engage us

Events that put assurance under scrutiny

Board

  • Board needs a clearer view of material risk
  • Existing Board pack reports activity, not assurance

Audit

  • Internal or external audit approaching
  • Unresolved findings carried between cycles

Regulatory

  • Regulatory scrutiny or enquiry expected
  • Evidence behind the regulatory position is uncertain

Transaction

  • Acquisition, integration or investor due diligence
  • Portfolio governance visibility needed

Procurement

  • Enterprise or public-sector buyer assurance requests
  • Supplier governance questioned by a customer

Sample outputs

Outputs written for decision-makers

Illustrative examples of the reports, registers, dashboards and working records that may be provided, depending on scope. IG-Smart never provides independent assurance over controls it designed or delivered.

Illustrative output

Independent Assurance Report

Assurance conclusion

An independent conclusion on the area reviewed, grounded in the evidence examined.

What it helps you see and do

  • Scope and evidence reviewed
  • Findings
  • Assurance position
  • Management response
  • Residual risk

Likely format

  • IG-Smart branded PDF
  • Evidence pack

Illustrative output

Assurance Findings & Action Register

Findings to action

Each finding linked to its evidence, risk and agreed management response.

What it helps you see and do

  • Finding and evidence
  • Risk
  • Management response
  • Owner, due date and status

Likely format

  • Action tracker
  • Spreadsheet / register

Illustrative output

Board Assurance Summary

Executive decision support

An evidenced view for the Board: position, residual risk and decisions.

What it helps you see and do

  • Current position
  • Top risks and residual risk
  • Progress and exceptions
  • Decisions required

Likely format

  • IG-Smart branded PDF
  • Board pack

Illustrative output

Assurance Monitoring View

Continuing assurance

Open and closed findings and overdue actions across assurance cycles.

What it helps you see and do

  • Open and closed findings
  • Overdue actions
  • Assurance status
  • Emerging issues
  • Review schedule

Likely format

  • Dashboard capture
  • IG-Smart branded PDF

Illustrative structure — not a client document. Exact outputs and formats depend on the agreed scope.

Relevant evidence

Relevant governance & assurance evidence

Selected published engagements showing independent review, audit readiness and governance decision support. They are not presented as Board Reporting engagements unless the approved case evidence says so.

Explore all case studies →Request Relevant Evidence →

How each case relates to this service

  • Security maturity and audit readiness for a FTSE 100 organisation — a three-stage governance and audit-readiness plan ahead of a third-party maturity assessment — evidence prepared to withstand independent scrutiny.
  • A nationwide data-governance audit of an insurer's offsite records-storage supplier — an independent, nationwide audit of a supplier, giving the client a structured assessment with findings and recommendations.
  • Repeatable governance integration for acquisitions at a global entertainment group — retained governance advisory creating a repeatable model for bringing acquisitions into the group’s governance.

Your IG-Smart team

Specialist expertise, coordinated around your requirement

Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.

Subject-matter expert

Michael Abtar

CEO and Founder

Governance, risk and assurance specialist with more than 18 years' experience spanning privacy, cyber resilience, AI governance, digital transformation, healthcare and complex regulated organisations.

View profile

Subject-matter expert

Professor Dame Donna Kinnair DBE

Chair, Independent Advisory Board

Senior healthcare and public-policy leader providing independent perspective across governance, leadership, patient safety, organisational assurance and healthcare transformation.

View profile

Client & programme contact

Julia Andrade

Head of Client & Programme Success

A key point of contact from prospective-client scoping through programme and project delivery, coordinating practitioners, workstreams and client stakeholders.

View profile

Independence

What independent assurance is — and is not

IG-Smart provides

  • Independent governance assessment and challenge
  • Audit readiness and assurance mapping
  • Decision-ready Board reporting
  • Work alongside Internal Audit, with roles agreed

IG-Smart does not provide

  • Statutory or financial-statement audit
  • Audit opinions
  • Legal opinions
  • Independent assurance over work IG-Smart managed or delivered

Investment

Starting investment: £10,000 + VAT

Typical investment: £12,500–£35,000+ + VAT. Scope, deliverables, assumptions and fees are agreed in writing before work begins.

Defined independent assurance engagement
A scoped review of agreed domains, reported to the Board or committee, at the investment shown above.
Ongoing governance and Board assurance
Continuing assurance across reporting cycles, scoped and quoted to requirement.

Talk to a Senior Practitioner How engagements & investment work

Fees reflect factors such as

  • Organisational complexity and number of entities or business units
  • Number of domains in scope
  • Depth of evidence examination and testing
  • Board and committee reporting requirements
  • Urgency, and any regulatory or transaction context
  • Remediation follow-up and frequency of continuing assurance

Questions

Frequently asked questions

What is the difference between management reporting and independent assurance?

Management reporting organises and communicates information. Independent assurance evaluates whether that information and its underlying evidence support sufficient confidence in the position. They are related but not interchangeable.

Does IG-Smart provide statutory audit?

No. IG-Smart does not provide statutory or financial-statement audit or audit opinions. It provides independent governance assessment, readiness and assurance support, and can work alongside your auditors.

Can IG-Smart improve an existing Board pack?

Yes. The aim is not reformatting but improving the quality of assurance reaching decision-makers — clearer materiality, ownership, evidence, findings and decisions required.

Can the engagement cover privacy, cyber, AI and supplier risks together?

Yes. IG-Smart can bring these domains into one organisational assurance view so the Board can see how the risks interact, drawing on specialist input where needed.

Need a Board view that is evidenced, owned and decision-ready?