Are you getting value from assurance?

What is changing?

 

Many top organisational risks that boards focus on now arise from business operations intersecting with economic challenges and heightened stakeholder expectations.

 

They rely heavily on comprehensive data and reliable operational controls over many transactions to manage the risk.

 

These include understanding stock and investing sufficiently in meeting the Decent Homes Standard (DHS) and Minimum Energy Efficiency Standards (MEES), as well as landlord health and safety and Awaab’s Law requirements, and understanding tenants’ diverse needs and risks surrounding rent setting, repairs or complaints.

 

For these top risks there is an expectation of regular management reporting, some separation of doing and checking, and periodic assurance on the reliability of underlying data.

 

Specialist assurance is sometimes needed when regulatory, legal or operating model changes are being implemented.

 

Boards must retain strategic oversight of key operational risks. To fulfil their responsibilities, they need high-quality reporting and targeted assurance that these risks are well-managed and expected outcomes are delivered. 

 

Assurance problems and solutions

 

It is important to match the assurance to the risk and to make sure it answers the right questions and achieves good value. In my experience, this is what to watch out for:

 

Make sure your testing is not too limited

 

Internal audit reviews of landlord health and safety compliance are often explicit in their reporting that substantive testing of data is not included, but many boards believe they are getting their main assurance on data accuracy and quality from these reviews.

 

Periodic specialist assurance and data reconciliation will supplement your internal audit reviews in this area. 

Avoid discovering what you already know

 

If the regulator or internal reporting has already identified weaknesses, commissioning a review that reconfirms them delays improvement. Sometimes the recommendations that come out six months later are already in the improvement plan.  

 

If you have weaknesses on data or governance, for example, ensure the scope of a review provides the assurance that moves you forward and includes the improvements needed. This might include getting a baseline reconciliation and understanding of data, a new skills assessment or advice on changing rules.

 

Do not rely too much on the three-lines model

 

The three-lines model of operational management, monitoring and assurance is helpful, but can sometimes feel like ‘box-ticking’ rather than understanding which controls are really reducing the risk. 

 

Think of up to six controls that do the heavy lifting for each key risk and then identify which line they are working. Don’t worry about every control at board level, but do make sure you understand that the most important controls are working well and if there are any gaps.

 

‘Right-size’ assurance

 

Before scoping assurance, boards or audit committees should consider whether it is routine and regular, or more specific to particular risks or situations that emerge.

 

Assurance options could include management reporting, pulse survey or follow-up review, internal audit, specialist assurance or advice, tenant scrutiny or audit committee deep dive.

 

Being thoughtful about how and when to deploy different assurance is what is needed, and sometimes it does need to be demonstrably independent. 

  

Join the dots

 

Assurance can come from many sources over time, so make sure you’ve considered thematic learning or insight.

 

During an inspection the regulator reads many board reports in a short period, making it easier to join the dots and spot themes.

 

You should understand how your organisation considers evidence in reporting which aligns or conflicts with current understanding, or suggests something more significant or an emerging theme, and then take appropriate action as a result.

 

Reporting assurance

 

When considering what paper needs to have full board oversight, the board should ask: “is this business-critical or high-risk?”

 

Committees work on behalf of the board, so it’s up to the board to decide what to delegate and receive from them. 

 

They should add something extra to board oversight. Boards should ‘follow the risk’ and ensure they have enough information to challenge on high risks, regardless of whether a committee has a role in oversight.   

 

Right now, I would expect the board to be receiving information on damp and mould performance following the implementation of Awaab’s Law.  

 

A relevant committee can provide monitoring and insight once implementation is embedded, but the board needs enough information to act if there is a problem. 

 

Similarly, if there is a step-change in new supply following new grant funding, this should trigger a review of reporting and assurance.

 

It would be great to have board-level conversations on scoping assurance to answer the right questions, joining the dots to leverage assurance for better insight and learning, and ensuring the level of testing is commensurate with the risk. This will all help the board to have an improved strategic oversight of business operations.

 

Kelsey Walker, director, Savills Affordable Housing Consultancy