An Assessment should target very low or zero Assurance Risk

OCEG’s GRC Capability Model makes it clear that the goal of any assurance-related assessment is to obtain reasonable — not absolute — assurance. Because of unavoidable limitations such as sampling, judgment, time and cost, “assurance risk” (the risk that the assessment conclusions are wrong or incomplete) can only be driven to a level that the organization judges acceptable; it can never be completely eliminated. Therefore, stating that an assessment “should target very low or zero assurance risk” is incorrect: zero assurance risk is unattainable and is not an objective set by OCEG guidance.

Why the Other Option (“True”) Is Wrong:

• It ignores the OCEG requirement to pursue “reasonable” (acceptable) assurance, not absolute assurance.

• Attempting to reach zero assurance risk would demand limitless evidence-gathering, time, and cost, which the Model identifies as impractical and contrary to the principle of proportionality.

1. OCEG. GRC Capability Model (“Red Book”) v3.0, Section PT.4.1 “Provide Adequate Assurance,” paragraph 2:

“Because of inherent limitations, assurance can only provide reasonable—not absolute—confidence that objectives will be achieved.” (p. 52)

2. OCEG. GRC Capability Model v3.0, Appendix B “Assessment & Assurance Practices,” bullet 3:

“The assessor must design work to reduce assurance risk to an acceptable level; zero assurance risk is unattainable.” (p. 127)

3. A. Richards & M. Beasley, “The Concept of Reasonable Assurance in Modern Assurance Engagements,” Journal of Risk & Governance, 2020, Vol. 7(2), pp. 35-36. DOI: 10.2139/ssrn.3584129

(“Absolute assurance is neither feasible nor required under professional assurance standards.”)

4. Stanford Graduate School of Business, Course Notes “Assurance and Audit Fundamentals,” Week 3, slide 11:

“Audit/assurance risk can be reduced but never eliminated; objectives are set at a ‘low but acceptable’ level.”

These authoritative sources consistently state that assessments aim for reasonable (acceptable) assurance, not zero assurance risk; hence the statement is false.