Assurance Map

List your principal risks. Name the functions that provide assurance over them — first line management, second line compliance and risk, internal audit, external auditors and regulators — and record what each one does, how often, and when it last happened. From then on the map computes, rather than asserts:

• Which risks have no current assurance at all.

• Which risks are covered only by work that has gone out of date, which is invisible in a spreadsheet and is the reason assurance maps stop being trusted.

• Which risks are covered only by the risk owner's own self-assessment, which is a materially weaker position than a single independent review and should never be reported as the same thing.

• Where the same risk is being reviewed twice on the same line of defence, which is assurance budget you are spending twice.

• Which of that work has a documented basis for reliance — competence, objectivity and adequacy of evidence — and which does not.

Take a snapshot before each audit committee and the position you reported stays answerable a year later, after every underlying row has moved on.

Who it is for: the chief audit executive, head of risk, head of governance or company secretary at an organisation that answers to an audit committee — housing associations, NHS trusts, universities and colleges, councils, credit unions, insurers, brokers and mutuals, charities above the audit threshold.

What it does not do: it reads nothing from your chats, files, mail, meetings or calendar, and it stores no audit report. Evidence is held as a reference or a link, never as a copy. The app asks for one Microsoft Graph permission — User.Read, the ordinary sign-in permission — and nothing on the list of permissions that require an administrator to consent to access your organisation's content.

Plan limits: the included plan covers one assurance map for a single team, up to five people and up to ten risks, with live coverage and currency analysis. Paid plans add unlimited risks and maps, assurance sources maintained from other teams and aggregated into one map, reliance analysis against the coordination and reliance standard, duplication findings, point-in-time snapshots and historic analysis, and the audit committee export. Known limitations in this version: rows cannot yet be edited or deleted after creation, there is no CSV import yet, and authoring is desktop and web rather than mobile.

Sign Up: https://am.maconapps.com/signup

Get Started: https://am.maconapps.com/start

Help: https://am.maconapps.com/help

Contact Us: https://am.maconapps.com/contact