How do NHS Boards get their assurance?

The transformation from “internal control” to “Board Assurance Framework” (BAF) represents a significant shift in both terminology and practice that has had far-reaching implications for NHS governance.

In this brief article, we’ll trace where the concept of “assurance” came from, and how it has taken eyes off both strategic, and operational balls to the detriment of Boards across the NHS.

The Origins in Internal Control

When NHS Trusts adopted the Unitary Board structure, they imported corporate governance principles from the private sector, including the fundamental concept of internal control.

This was rooted in clear management processes: identifying risks, establishing controls, testing their effectiveness, and reporting on their operation. The approach was practical and process-driven, focused on management actions and measurable outcomes.

The Shift to “Assurance”

The evolution to the BAF concept marked a subtle but important change. While ostensibly designed to give boards better oversight of strategic risks and controls, it introduced more abstract concepts of “assurance.”

This shift had several key consequences:

Abstraction of Management Responsibility

The focus moved from direct management control to receiving “assurance” about controls. This created a layer of abstraction between the board and actual operational management. Instead of discussing specific control measures, boards began receiving “levels of assurance” – often categorised as red/amber/green ratings that could mask underlying issues.

Proliferation of Assurance Activities

The emphasis on “gaining assurance” led to an explosion of assurance-gathering activities: audits, reviews, reports, and committees. This created what might be called an “assurance industry” within the NHS, where the process of gaining assurance became an end in itself rather than a means to effective control.

Semantic Debates

The term “assurance” became increasingly contested. Different stakeholders developed varying interpretations of what constituted “adequate assurance.” This led to ongoing debates about whether particular pieces of evidence or reports provided “real assurance” – a debate that would have been less likely when focusing on specific control measures.

Loss of Direct Connection to Risk Management

While the BAF was supposed to link strategic objectives, risks, and controls, the focus on assurance often led to a disconnect. Boards could receive multiple sources of “assurance” while losing sight of whether fundamental risks were actually being managed effectively.

The Impact on Board Effectiveness

This transformation has affected how boards function in several ways:

• Boards spend considerable time discussing the quality and sufficiency of assurance rather than addressing actual risk management
• The proliferation of assurance activities has created a large overhead of reporting and documentation
• The abstract nature of “assurance” can make it harder for boards to challenge management effectively
• The focus on assurance processes can detract from attention to actual operational effectiveness

Current State and Challenges

Today, NHS boards often struggle with:

• Determining what constitutes “sufficient assurance”
• Managing the volume of assurance activities and reports
• Maintaining focus on actual risk management rather than assurance processes
• Avoiding the trap of treating assurance as a tick-box exercise

The Way Forward

To regain effectiveness, NHS boards might benefit from:

• Returning to more direct focus on control effectiveness rather than layers of assurance
• Simplifying assurance frameworks to focus on key risks and controls
• Reducing the volume of assurance activities in favor of more targeted, meaningful oversight
• Reconnecting assurance processes to actual risk management and operational effectiveness

This evolution from internal control to board assurance represents a case study in how well-intentioned governance concepts can become overly complex and potentially less effective when transformed into sector-specific frameworks. The challenge now is to maintain the benefits of structured oversight while avoiding the pitfalls of excessive abstraction and process-focus that the current approach to “assurance” has sometimes created.

Words of Assurance – Taking it on Trust in the 21st Century NHS Boardroom Share on X