1. Assurance does not arise simply from audits or reviews. Assurance starts with the design and operation of an activity.
2. Top management may establish management review activity independent of line operations to monitor and report on the activity.
3. The governing body may request internal audit to provide assurance independently of management. When using an integrated model of assurance, the governing body will expect reporting from all relevant lines.