Water Industry Commission for Scotland - independent review: sponsorship oversight and governance

Annex A: Definition of Assurance and Recommendation Categories

Assurance Levels

Substantial Assurance – Controls are robust and well managed: Risk, governance and control procedures are effective in supporting the delivery of any related objectives. Any exposure to potential weakness is low and the materiality of any consequent risk is negligible.

Reasonable Assurance – Controls are adequate but require improvement: Some improvements are required to enhance the adequacy and effectiveness of procedures. There are weaknesses in the risk, governance and/or control procedures in place but not of a significant nature.

Limited Assurance – Controls are developing but weak: There are weaknesses in the current risk, governance and/or control procedures that either do, or could, affect the delivery of any related objectives. Exposure to the weaknesses identified is moderate and being mitigated.

Insufficient Assurance – Controls are not acceptable and have notable weaknesses: There are significant weaknesses in the current risk, governance and/or control procedures, to the extent that the delivery of objectives is at risk. Exposure to the weaknesses identified is sizeable and requires urgent mitigating action.

Recommendation Priority

High: Serious risk exposure or weakness requiring urgent consideration.

Medium: Moderate risk exposure or weakness with need to improve related controls.

Low: Relatively minor or housekeeping issue.