An assurance review is not simply a search for completed forms. It tests whether the controls relied upon to prevent serious events are suitable, present and working where the risk exists.
01 / PRACTICAL GUIDANCE
Begin with the risk and the promised control
The review should identify the unwanted event, the control intended to prevent or mitigate it, and the performance expected from that control. This creates a direct line from risk to verification.
Without that line, assurance activity can become a broad inspection that records many observations but gives limited confidence about the controls that matter most.
- Define the critical activity or scenario
- Identify preventive and mitigative controls
- Clarify performance requirements
- Select evidence that can genuinely test control health
02 / PRACTICAL GUIDANCE
Test work as performed
Written procedures are one source of evidence, not the whole answer. Reviewers should compare documents with permits, equipment condition, worker understanding, supervision and the actual work environment.
Useful sampling follows a decision or task from planning through authorisation, execution, verification and closure.
03 / PRACTICAL GUIDANCE
Separate presence from effectiveness
A control may exist on paper yet be unavailable, misunderstood, bypassed or poorly maintained. Assurance should ask whether it is capable of delivering the required performance and whether deterioration would be detected early.
For human controls, check role clarity, competence, workload and supervision. For engineered controls, examine availability, testing, maintenance and known impairments.
04 / PRACTICAL GUIDANCE
Close actions with evidence
The number of closed actions is not a reliable measure if closure evidence is weak. Actions should have accountable owners, proportionate priority, realistic due dates and clear acceptance criteria.
Independent verification is especially important where an action addresses a critical-control failure or recurring high-potential exposure.
KEY TAKEAWAYAssurance should demonstrate whether critical controls work in operating reality. Completed documents support that conclusion; they do not replace it.
QUESTIONS PROFESSIONALS ASK
Frequently asked questions
How is operational assurance different from an inspection?+
An inspection often identifies conditions at a point in time. Operational assurance deliberately tests the design, availability, use and verification of controls relied upon to manage defined risks.
Should every control be treated as critical?+
No. Criticality should be based on the control’s role in preventing or mitigating a material unwanted event. Treating everything as critical weakens prioritisation.
This article provides general professional guidance, not legal advice, certification or a site-specific technical conclusion. Requirements and suitable methods depend on the jurisdiction, evidence, operating context and agreed scope.