When management says 'we are assured', what should a director ask next?

'We are assured' is a common and often entirely sincere phrase in board reporting. But it can conceal several different propositions: management has checked that a process exists; a team believes it is working; a committee has considered a report; or independent evidence indicates that controls are effective.

Those are not interchangeable.

The starting point is not to dispute the statement. It is to ask what kind of assurance is being offered.

Establish the claim

Ask: 'What exactly are we assured about?' An organisation can have assurance that an improvement programme is on schedule without yet having assurance that the programme has improved outcomes.

Examine the basis

Ask: 'What evidence supports that, and what is not covered?' Distinguish internally produced management information from independent testing, direct observation and feedback from the people affected.

Test contradictory signals

Ask: 'What might tell us a different story?' An improving aggregate measure can coexist with poor performance in a particular locality, service, group or stage of a pathway. Averages may hide outliers.

Understand the consequence

Ask: 'What would trigger escalation or a change in plan?' Assurance is stronger when the board knows the threshold at which the narrative would be reconsidered.

Secure follow-through

Ask: 'What will come back to the board, and when?' A question that receives a plausible but incomplete answer should not depend on somebody's memory next quarter.

These questions are not a script for adversarial governance. An effective board needs a productive relationship with management. Specific, respectful questions allow both sides to be clearer about the degree of confidence justified by available evidence.

Some boards also have specific reporting obligations. The Financial Reporting Council's UK Corporate Governance Code 2024 addresses the monitoring and review of material internal controls for companies within its scope. Its provisions should not be presented as requirements for every charity, public body or other board.

For boards: When you hear an assurance conclusion, distinguish what management believes, what has been checked and what has actually been demonstrated.

BoardCue's actions and decisions features provide structured follow-through for organisation deployments. A recorded action still needs a named owner, an appropriate deadline and evidence before it is closed.