Which statement best describes assurance activities within risk management?

Which statement best describes assurance activities within risk management?

• A. They replace management's responsibility for controls.
• B. They are optional for most organizations.
• C. They involve only external audits.
• D. They include internal audit, compliance, and external assurances mapped to risks and controls to identify gaps and coverage.

Answer: (D)

Assurance activities provide an independent evaluation of how well risk management and internal controls are working to give stakeholders confidence. They supplement management’s responsibility by offering objective evidence on effectiveness and by spotting gaps in coverage. This is achieved by drawing on internal audit, compliance activities, and external assurance providers, all mapped to the relevant risks and controls so you can see where coverage exists and where gaps remain. Because of this mapping, you can coordinate assurance efforts across different providers to strengthen overall governance. The other statements miss important elements: assurance does not replace management’s responsibility for controls, it is not merely optional in most organizations, and it is not limited to external audits—it encompasses internal audit and compliance as well as external assurances.

Assurance activities provide an independent evaluation of how well risk management and internal controls are working to give stakeholders confidence. They supplement management’s responsibility by offering objective evidence on effectiveness and by spotting gaps in coverage. This is achieved by drawing on internal audit, compliance activities, and external assurance providers, all mapped to the relevant risks and controls so you can see where coverage exists and where gaps remain. Because of this mapping, you can coordinate assurance efforts across different providers to strengthen overall governance. The other statements miss important elements: assurance does not replace management’s responsibility for controls, it is not merely optional in most organizations, and it is not limited to external audits—it encompasses internal audit and compliance as well as external assurances.