King IV
Three Lines Assurance Mapping
Coverage of key risks across management, oversight and independent assurance lines.
Why combined assurance prevents coverage gaps
Risks fall through the cracks when no one is sure whether management, oversight functions or independent assurance providers are actually covering them. King IV's combined assurance model and the IIA Three Lines framework exist precisely to make assurance coverage deliberate rather than accidental. AuditPro Core maps each key risk across the management, oversight and independent assurance lines so the audit committee can see, at a glance, where coverage is duplicated, thin or absent.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Risks with 3-line cover
41%
First-line only
29%
Assurance duplication
12 risks
Uncovered risks
6
Assurance lines by risk category
Coverage gaps
| Risk | Lines covering | Gap |
|---|---|---|
| Revenue under-billing | 1 | No independent assurance |
| Cyber resilience | 2 | No 2nd-line testing |
| Project delivery | 1 | Management self-report only |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
The three lines
The first line owns and manages risk operationally; the second line provides risk and compliance oversight; the third, internal audit, gives independent assurance. Clear separation prevents any line from marking its own homework.
Combined assurance
King IV asks the board to ensure that the combination of internal and external assurance providers gives an effective, coordinated view of risk. The goal is comprehensive coverage without wasteful overlap.
Coverage gaps and over-assurance
A risk with no assurance line is an exposure; a risk covered three times over is wasted effort. Mapping reveals both, allowing assurance resources to be redirected to where they are genuinely needed.
How AuditPro Core Bridges the Gap
- Risk-to-line mapping: records which line provides assurance over each key risk in the register.
- Gap detection: flags risks with no assurance coverage or with redundant duplication.
- Continuous monitoring: updates the coverage view as the risk register and assurance plans change.
- Audit-ready export: produces a combined assurance map for the audit committee and annual report.
Key Takeaways
- Separate the three lines so no function assures its own work.
- An uncovered key risk is a coverage gap that demands action.
- Redundant assurance signals an opportunity to reallocate scarce resources.
- Combined assurance is a board responsibility under King IV, not a tick-box.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.