Risk Academy, a Nexortium programmeRisk Science and MethodsDepartment of Risk Management

Internal control, independent assurance, control testing and the culture behind risk behaviour

Assurance, internal control and risk culture

Assurance is evidence that others can check, not a declaration.

risksacademy.comrisk-sciencediscipline

Assurance, internal control and risk culture, drawn as uncertainty bands: 0 primary courses open, 1 in preparation, 0 approved for authoring and 1 also taught here, across 8 subtopics. Courses: RAT-225 L2 in preparation, RAF-108 L1 also taught here.L1L2L3L420
Assurance, internal control and risk culture at a glance. Drawn as uncertainty bands.
  • Open, 0
  • In preparation, 1
  • Also taught here, 1
  • Subtopics, 8
Course codes from the curriculum; study levels L1 to L4.
Twin builder and simulatorThe central Apennines: L'Aquila, Amatrice and Norcia4 twin generators, 8 layers, 4 instruments
courses open now
0
in preparation
1
subtopics in its scope
8
reference earthquakes, M6.2 to M6.6
3

Twin figures for the central Apennines: L'Aquila, Amatrice and Norcia, counted from its layers at their stated dates.

Twin builder and simulator.

For Assurance, internal control and risk culture: the faculty's twin of L'Aquila on the planet map, the globe and in 3D. Pick a generator, switch layers, run the instruments; every layer prints its provider and date.

The central Apennines: L'Aquila, Amatrice and Norcia: a flat plan of the faculty twin. Terrain 24 to 2,805 m; 3 reference earthquakes, M6.2 to M6.6; Earthquakes M4.5 and above, past week (live): live, loads in the twin; USGS ShakeMap intensity contours: live, loads in the twin. Contours every 500 metres from the elevation grid; reference earthquakes as marks.
The central Apennines: L'Aquila, Amatrice and Norcia, Italy. Flat plan of the same data: relief, the three reference epicentres with magnitude and depth, and the numbers below; the sampler's figure shows one precomputed field with its parameters. The 3D twin opens on devices with WebGL once its data and library have been checked.
  • Terrain 24 to 2,805 m
  • 3 reference earthquakes, M6.2 to M6.6
  • Earthquakes M4.5 and above, past week (live): live, loads in the twin
  • USGS ShakeMap intensity contours: live, loads in the twin
Credits and dates per layer are listed under the stage. Relief in the twin is exaggerated ×1.5 for legibility.

Drag to move, right drag or Shift with a drag to turn and tilt, Ctrl with the wheel to zoom. Keyboard: arrows move, Shift with arrows turn and tilt, + and - zoom, 0 resets, V steps through the views, Escape clears.

Flat plan of the same data: relief, the three reference epicentres with magnitude and depth, and the numbers below; the sampler's figure shows one precomputed field with its parameters. The 3D twin opens on devices with WebGL once its data and library have been checked.

The map loads from this site as it nears the view (MapLibre 6.9.1, checked by hash).

The discipline in brief.

The discipline teaches internal control frameworks, the Three Lines Model in practice, internal audit and independent assurance, control design and testing over a period, risk culture and conduct, incentives and accountability, reputational risk and assurance reporting to boards, with the twin's provenance records per layer as the model of an evidence trail. A graduate can design a control, test that it operates, and write an assurance opinion that states its evidence and its limits.

This area covers how organisations gain confidence that risks are managed as intended: internal control frameworks, internal audit and independent assurance, control testing, reputational risk and the culture and incentives that shape risk behaviour. It is taught in the department of Risk Management, Faculty of Risk Science and Methods, through 1 course with it as primary discipline and 1 more that also teach it.

What the discipline covers.

8 subtopics, taught across its courses and labs.

Courses
0 open, 1 in preparation
Levels
L2 Intermediate
Labs
Named when the courses are authored
  • Internal control frameworks
  • The Three Lines Model in practice
  • Internal audit and independent assurance
  • Control design and testing
  • Risk culture and conduct
  • Incentives and accountability
  • Reputational risk
  • Assurance reporting to boards

What is changing now.

Recent developments in assurance, internal control and risk culture, each with its source; sources checked on 16 October 2026. Summaries are short readings of the source; follow the link for the full account.

The faculty hub.

News and research as they are published, per discipline, with the faculty's other tools.

The newest research, preprints, news and humanitarian reports for Assurance, internal control and risk culture, each with its source and date, load here. Open the research and news hub

Frameworks and standards it works with.

From the Academy's risk taxonomy: the discipline's own entries and those of its primary courses, with how many courses teach each.

Frameworks and standards

  1. COSO Internal Control frameworkscope

Hazard families

  1. Disinformation and information integrity1 course

1 in preparation.

No course with this primary discipline is open yet; these are planned, so you can prepare with the courses also taught here.

Courses with this primary discipline0 open, 1 in preparation

  1. RAT-225Reputational Risk and Stakeholder TrustIn preparationTechnical, L2 Intermediate, 6 hours (estimate)

Courses from other disciplines.

These courses count in their own primary discipline and also teach this one; they do not count towards its achievement as primary courses.

Also taught here1 courses that count in another discipline

  1. RAF-108Enterprise Risk Management Foundations: COSO ERM and Risk AppetiteIn preparationFoundation, L1 Introductory, 8 hours (estimate), primary in Enterprise risk management and risk frameworks

Where the subject is worked on.

Cited as places where the subject is practised; the institutions named are sources here, and Risk Academy hosts every course.

The Foundry system where it is practised.

  • Nexus FoundryNSF systemAssurance and internal controlAssurance room, Commons room

Nexus Foundry system pages describe what each system and its rooms are designed to do; they are not a service on offer, and studying here gives no access to them.

What you can earn here.

Terms used on this page.

Assurance, internal control and risk culture

Prepare with a related course.

Open courses in connected disciplines teach the methods this discipline will build on.

Skip to toolbar