The Global Centre for Risk and Innovation (GCRI)
Assurance asks whether risk management works as described; correction makes sure that when it does not, records and decisions change. Internal audit, independent review, incident investigation and learning systems provide the checks. This page sets out how assurance is organized, why it can miss systemic weaknesses, and how corrections are recorded so that the evidence behind a decision stays traceable after the facts change.
GCRI · In development · service level R0
Risk assurance is the objective examination that gives a stated level of confidence that risk management, controls and governance work as intended. Internal audit, independent review and incident investigation supply it. Correction makes sure that when evidence proves wrong, records and decisions change and earlier versions stay traceable.
For assurance and correction, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, night lights and population density, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Hazards and exposure, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For assurance and correction, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, night lights and population density, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Assurance and correction · Enterprise A · Review cycle Q4
likelihood × impact, risks per cell
Counts of risks per cell. Shading follows the appetite bands.
| Supplier concentration | Procurement | High | ▲ 2 |
| Data centre flooding | Operations | High | ▲ 0 |
| Model error in pricing | Finance | Medium | ▲ 1 |
| Key staff loss | People | Medium | ▼ 1 |
Evidence, review and methods correction. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Reviews examine the processes and records put in front of them. Risks that fall outside the scope, or between the scopes of several reviewers, go untested.
Incident reviews that end at the person or component closest to the failure miss the organizational and design conditions behind it. Those conditions remain and produce the next incident.
When an assumption, dataset or model proves wrong, decisions built on it need revisiting. Without versioned records, the correction is made in one place and the error persists elsewhere.
Audit and incident actions are agreed, then deferred as priorities shift. Overdue actions accumulate and the weaknesses they were meant to fix stay open.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Three Lines Model | The IIA model describing the roles of management, risk and compliance functions, and internal audit in governance and assurance. |
| Assurance map | A record of which risks are reviewed by which assurance providers, used to find gaps and overlaps. |
| Root cause analysis | A structured method for finding the underlying conditions that allowed an incident to occur. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Principal risks covered by assurance | percent of principal risks reviewed in the cycle | annual | Assurance maps | REPORTED |
| Overdue audit actions | count by age band | quarterly | Audit action tracking | REPORTED |
| Incident investigations reaching organizational factors | percent of investigations | annual | Investigation reports | REPORTED |
| Corrections issued to published risk evidence | count with reason recorded | continuous | Correction log | OBSERVED |
| Repeat incidents | count of incidents with a previously identified cause | annual | Incident databases | OBSERVED |
| Independent reviews of the risk framework | date of last external review | per review | Governance records | DECLARED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Global Internal Audit Standards | Requirements for internal audit independence, planning and reporting, from The Institute of Internal Auditors | Public, IIA terms of use |
| The IIA Three Lines Model | Roles of management, risk functions and internal audit in assurance | Public, IIA terms of use |
| National audit office reports | Independent public sector audit findings on risk and resilience | Public records, licence per office |
| Safety investigation board reports | Investigations that trace organizational and systemic factors | Public records, terms per board |
| Retraction Watch database | Records of retracted and corrected research used in evidence bases | Open, Crossref terms (to check) |
Systemic Risk Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Audit committees | Whether assurance over principal risks is sufficient and independent | Assurance maps; overdue actions; external review dates |
| Chief audit executives | Where to direct audit effort in the next plan | Coverage gaps; repeat incidents |
| Public accounts committees and legislatures | Whether public bodies have acted on findings | Audit office reports; action status |
Assurance tends to erode quietly. Reviews become routine, findings repeat from one cycle to the next and the people being reviewed learn what reviewers look for. Major failures often follow years of assurance reports that described controls as effective.
Reviewers who depend on those they review, or who designed the controls, find fewer problems.
Assurance that checks whether processes are documented rather than whether they work.
Methods and models changed without records, so no one can tell what earlier results relied on.
Independent testing of models against data, benchmarks and expert review, using uncertainty quantification and model validation. Limits: validation is harder for models of rare events.
Independent review of controls and governance. Limits: audit samples, and its findings depend on scope.
Records of data, code and method versions behind each result. Limits: requires discipline to maintain.
Published corrections with reasons and dates. Limits: requires a culture that values correction over reputation.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.