Skip to content

Illustrative: branching futures, each branch weighted by its probability

Risk Academy, led by the Nexus Consortium · Risk Science and Methods · Department of Risk Management

Internal control, independent assurance, control testing and the culture behind risk behaviour

Assurance, internal control and risk culture

Assurance is evidence that others can check, not a declaration.

Map assurance, internal control and risk culture on a real place See the courses
01Scope

What the discipline covers

The subtopics its courses and labs teach.

Courses
In preparation
Levels
L2 Intermediate
Labs
In development
  • Internal control frameworks
  • The Three Lines Model in practice
  • Internal audit and independent assurance
  • Control design and testing
  • Risk culture and conduct
  • Incentives and accountability
  • Reputational risk
  • Assurance reporting to boards
02Maps

Build a twin of any place

Search any place or open the world; the layers and generators follow assurance, internal control and risk culture on the planet map, the globe and in 3D.

The central Apennines: L'Aquila, Amatrice and Norcia: a flat plan of the faculty twin. Terrain 24 to 2,805 m; 3 reference earthquakes, M6.2 to M6.6; Earthquakes M4.5 and above, past week: read live when the 3D twin opens; USGS ShakeMap intensity contours: read live when the 3D twin opens. Contours every 500 metres from the elevation grid; reference earthquakes as marks.
The central Apennines: L'Aquila, Amatrice and Norcia, Italy. Flat plan of the same data: relief, the three reference epicentres with magnitude and depth, and the numbers below; the sampler's figure shows one precomputed field with its parameters. The 3D twin opens on devices that can draw it, once its data and code have been checked.
  • Terrain 24 to 2,805 m
  • 3 reference earthquakes, M6.2 to M6.6
  • Earthquakes M4.5 and above, past week: read live when the 3D twin opens
  • USGS ShakeMap intensity contours: read live when the 3D twin opens
Credits and dates per layer are listed under the stage. Relief in the twin is exaggerated ×1.5 for legibility.

Drag to move, right drag or Shift with a drag to turn and tilt, Ctrl with the wheel to zoom. Keyboard: arrows move, Shift with arrows turn and tilt, + and – zoom, 0 resets, V steps through the views, Escape clears.

Flat plan of the same data: relief, the three reference epicentres with magnitude and depth, and the numbers below; the sampler's figure shows one precomputed field with its parameters. The 3D twin opens on devices that can draw it, once its data and code have been checked.

The boundaries, names and designations shown do not imply any judgement on the legal status of any territory, or any endorsement or acceptance of such boundaries. Countries: Natural Earth (public domain).

03Live map

Hazards and exposure in Italy

Flood water, active fires and surface heat beside population and night-time lights, over Italy.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 3

Hazards and exposure

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

Hazards and exposure, framed on Italy.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONET · U.S. Geological SurveySources and licences

  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • NASA Fire Information for Resource Management System (FIRMS), VIIRS 375 m active fire product, NASA LANCE; vector tiles via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
  • VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • MODIS and VIIRS atmosphere products, NASA LANCE and LAADS DAAC; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
  • Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
  • © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). ODbL
  • Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
  • Globe: MapLibre GL JS 6.9.1, BSD-3-Clause, © MapLibre contributors.
  • Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
  • Live: NASA EONET Events are indicative, not authority warnings.
  • Live: U.S. Geological Survey Events are indicative, not authority warnings.
  • NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • River discharge forecast, 30 days with range (GloFAS via Open-Meteo): Contains modified Copernicus Emergency Management Service information 2026; not a flood warning.
  • Weather data by Open-Meteo.com (https://open-meteo.com/), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
  • Optional layers (10 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

  • Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
  • Active fires and thermal anomalies: VIIRS NOAA-20 375 m (FIRMS), NASA LANCE FIRMS · 13 Oct 2026
  • Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
  • Land surface temperature, day, 8-day composite: VIIRS NOAA-20 Level 3, 8-day, NASA LANCE · 14 Sep 2026
  • Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
  • Aerosol optical depth, daily: VIIRS NOAA-20 Deep Blue AOD, NASA LANCE · 13 Oct 2026

04The subject

The subject, methods and measures and debates and bodies

The field and its scope

For internal auditors, control owners, audit committee members and risk culture leads who need evidence, rather than assertion, that risks are managed as intended.

05The method

From a sample of control operations to an audit conclusion: deviations, the upper bound and the tolerable rate

A control is tested on a sample; the deviations found give a rate, and the sample size gives an upper confidence bound on that rate; the bound is compared with the rate the auditor can tolerate, and the comparison, read alongside what the culture indicators say, is the assurance conclusion.

Sources: COSO, Internal Control, Integrated Framework (2013); The Institute of Internal Auditors, Global Internal Audit Standards (2024); Wilson, Probable inference, the law of succession, and statistical inference, Journal of the American Statistical Association (1927); Brown, Cai and DasGupta, Interval estimation for a binomial proportion, Statistical Science (2001); Power, The Audit Society: Rituals of Verification (1997).

06At a glance

At a glance, with 5 related topics

Assurance, internal control and risk culture at a glance

risksacademy.comrisk-sciencediscipline

Assurance, internal control and risk culture: 0 primary courses open, 1 in preparation and 1 also taught here, across 8 subtopics. Courses: RAT-225 L2 in preparation, RAF-108 L1 also taught here.L1L2L3L420
Assurance, internal control and risk culture at a glance
  • Open, 0
  • In preparation, 1
  • Also taught here, 1
  • Subtopics, 8
Course codes from the curriculum; study levels L1 to L4.
Twin builderBuild a twin of any placeWorked example: the central Apennines: L'Aquila, Amatrice and Norcia · 4 generators · 7 layers · 4 instruments
07Console

How Assurance, internal control and risk culture is taught, as a process you can run

Press Play to run this process from this page's own data.

08Learning

Learning, practice and connections

Achievements in this discipline

09Take part

Take part in Risk Science and Methods

Start from who you are.

10References

Core references and where to begin

Start with COSO, then The Institute of Internal Auditors, then The Institute of Internal Auditors.

11Questions

Questions, answers and key terms

Is study here free?
Yes. Every course and learning material of Risk Academy, led by the Nexus Consortium, is free to study, self-paced or with a cohort. Ordinary participation has no fee; paid work, internships and fellowships are separate arrangements.
What does completing a course give me?
A completion record: the course, its version, the date and what was assessed, private by default and shared by you. It stacks into discipline, department and programme achievements. A record states what was studied and assessed and does not certify competence; it is not a licence, a professional title or an employment status.
Where do the data and the places come from?
Every faculty teaches on a twin of a real place built from open data; each layer carries its provider, licence and date, and every result on the Academy states its source. Maps and figures are indicators for teaching, never an assessment of a place.
How do I take part beyond the courses in assurance, internal control and risk culture?
Form a competence cell of three to seven people, study a shared pathway, take a supervised assignment in the National Working Groups, or bring a cohort from your institution. For organisations.

Key terms

Term

Internal control

A process designed to provide reasonable confidence that objectives on operations, reporting and compliance are met.

Term

Assurance

An objective examination of evidence that gives an opinion on how well risks are managed.

Term

Control testing

Checking that a control is designed well and operates as intended over a period.

Term

Risk culture

The shared values, beliefs and behaviours that shape how people in an organisation take and manage risk.

ReportsContribute

Contribute evidence from this page.

Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Risk Academy
Related

Around Assurance, internal control and risk culture

Assurance, internal control and risk culture

Prepare with a related course

Open courses in connected disciplines teach the methods this discipline will build on.

Browse the course catalogue Back to Department of Risk Management