Reporting has become a performance
Ask a board how confident it is in its risk position and you will usually get a considered answer. Ask what evidence sits behind that confidence and the room tends to narrow. Dashboards, RAG ratings and incident statistics are produced diligently, but they are produced by the same function that is being assessed.
That is the structural problem. Assurance that originates inside the delivery line, however well-intentioned, is management self-assessment dressed as independent oversight.
Three questions that expose the gap
First: if the organisation's largest risk crystallised tomorrow, what would the board have known in advance, and when? Second: which of the numbers in the pack have been independently tested, and by whom? Third: what has the board been told that it did not want to hear in the last twelve months?
A board that cannot answer all three clearly does not have assurance. It has reporting.
Closing it
Independent assurance has to sit outside the delivery line, be designed around the decisions the board actually makes, and be willing to publish a rating that the executive team would rather not see.
The cadence matters as much as the method. Assurance that arrives twice a year cannot inform a decision made in March.
Assurance is not a document. It is the willingness to be told something inconvenient, on a schedule you did not choose.
