Evidence for Board Assurance

Evidence for board assurance is the material a board needs to judge whether the resilience assurance it receives is grounded in observed performance or in assertion. A board cannot test services itself, and it cannot read every record, so it depends on a distilled account: which important services were examined, what the evidence showed for each one, where the gaps are, and what is being done about them. The quality of that account decides whether the board is genuinely assured or merely reassured.

A good board pack therefore leads with services and evidence, not with programme activity. It should show, for each important service, its tolerance, its most recent test or incident result measured against that tolerance, and its open actions, with failures and gaps stated as plainly as successes. A pack that reports only activity, such as the number of tests run or plans updated, without showing what those activities revealed about services, gives the board motion without meaning, and it should not be accepted as assurance.

A board should see a service-by-service picture, even if it is brief. For each important service, the pack should state the service, its tolerance in plain terms, the latest evidence about performance against that tolerance, and the most significant open gap or action. That structure lets board members compare services, notice which services have not been tested recently, and ask why a particular gap remains open, without needing technical detail about every control.

A board should ask which services were not examined in the period, and why, because assurance that covers only the strongest services is misleading. It should ask what the most recent test or incident revealed that was unwelcome, because a period with no unwelcome findings usually means the checking was not searching hard enough. It should ask which findings remain open beyond their dates, and what escalation has followed, because overdue actions are a signal about the firm's ability to close gaps, not just about the gaps themselves.

A board should also ask about the basis of the assurance it is given. Was the underlying work internal audit, external assurance, self-assessment, or testing, and what were the limits of each? A board that understands the limits of its sources will not mistake a narrow external report for general assurance, or a self-assessment for independent testing. Those questions are not a sign of distrust; they are the board doing the job that assurance exists to support, which is to challenge and to understand.

Different sources of assurance carry different weight, and a board pack should label them. Internal audit provides independent challenge from inside the firm, but its scope is chosen by the firm and its findings depend on its access. External assurance provides outside independence, but only within its agreed scope and wording. Self-assessment provides the firm's own honest judgement, but it is not independent. Testing and incident experience provide observed performance, but only for the scenarios and events they covered.

Gaps should be presented plainly, with their service, their significance for users, their owner, and their date, and they should remain visible until closed on evidence. A gap that disappears from the pack because it is inconvenient, or because it has been open for a long time, has not been resolved; it has been hidden, and the board's assurance is then based on an incomplete picture. Persistence is a virtue in board reporting, because it keeps attention on the work that remains.

The board's role is not to master every technical detail of resilience, but to set the expectation that assurance will be evidence-based, to challenge the account it receives, and to ensure that significant gaps are resourced and closed. That role includes asking for the underlying evidence when a judgement seems surprising, requesting a deeper look at a service that has not been examined, and resisting the temptation to accept a reassuring summary in place of a service-level account.

The board should also model the honesty this cluster advocates. If board members reward candid reporting of gaps and penalise polished summaries that hide them, the firm's reporting will become more candid. If they do the opposite, reporting will become more polished and less true, and the board will be the first to suffer, because it will make decisions on assurance that does not reflect the firm's real position. Board assurance is therefore a two-way discipline: the firm must provide evidence, and the board must insist on it.