Triangulated assurance

How do I know that’s right? Is the data correct? How do I trust what you are saying? These are all phrases frequently thought and sometimes spoken by boards and committees when presented with reports or given verbal reassurance by executives either that things are ok or that actions are working.

In previous bulletins, we’ve addressed the relationship between the board and executive and also how boards need to build trust as part of their development. Nonetheless, often boards feel they are being ‘reassured’ rather than ‘assured’ – data often presented but that nagging feeling that something still isn’t quite right.

Triangulation

One of the ways boards can feel assured rather than just reassured is by adopting a triangulated assurance approach. This is about not just relying on what is written, but also by observing and listening to how the organisation is operating.

1. Data and information – these are in the form of reports you receive at board such as integrated performance reports, strategy updates and improvement plans. Data should be benchmarked with targets in place where possible with key milestones and trajectories. Other evidence should be provided in reports.

2. People – This is when you speak with stakeholders such as staff, patients, commissioners, regulators and partners. Discussions should focus on what you have read and the data provided to ascertain whether it paints a true picture.

3. Observe – This can be in the form of tours or walk-arounds but you need to put yourself in the shoes of the patient or staff member. These can be relatively informal, giving you an opportunity to understand how things really are.

If what you hear and observe does not fit with what has been written or what you have been told, then you don’t have triangulated assurance. And that should be a prompt to ask further questions.

Three lines of assurance

Triangulated assurance is a way of testing information being provided to ensure it is accurate. But assurance comes in multiple forms and in multiple stages.

It starts with management: testing controls to ensure the rights things are being done and they are having the necessary impact.

Then there is internal assurance. The board and committees should see this as part of the reporting structures. This is not only by executive reports but also the corporate teams such as those in risk, HR and health and safety providing support.

Lastly there is external assurance. These are inspections, reviews, regulation and audits, all done by people and organisations external to the organisation.

Assurance should be accurate at all stages. If either internal or external assurances find issues with what has been provided at management level, then there will be a need to revise the assurances at management level.

COVID-19 impact

The coronavirus pandemic has meant many boards have not been able to go into their organisations in the usual way to see how they have been coping, so they have felt they had to rely more on their executive colleagues to understand the organisation – normally through briefings.

This is understandable, but boards should still strive to use non-contact means to receive triangulated assurance. Virtual meetings, telephone calls or emails with colleagues and stakeholders are all means of gaining assurance without walking on site, as long as it is done with discretion.

The three lines of assurance have also been impacted by COVID-19 – with many corporate teams working from home, a rationalisation of meetings and auditors having to work virtually.

Despite these constraints, boards can still gain assurance from these lines but it will need to be focused on the areas of strategic importance for the organisation.

Immediate actions

This is a good time for boards to review their audit cycle and corporate priorities, to ensure they are focused on the strategic objectives of the organisation, linking to the board assurance framework and principal risks.

Ultimately, assurance is there to help organisations stay on track to achieve their strategic objectives. Even in these difficult times, triangulation and the three lines of assurance need to be maintained but focused to ensure battling COVID-19 is captured within the assurance mechanisms, and doesn't remove focus from them.

Questions for boards

Do we have the opportunity to speak with and observe staff, patients and our stakeholders? And do we link this to what is reported to the board?

• Is our audit cycle and our corporate priorities linked to our strategic objectives and our board assurance framework?
• Have we tested our management line of assurance with our internal and external lines?

If this briefing prompts any questions or comments, please call us on 07732 681120 or email advice@good-governance.org.uk