Security, Audit and Leadership Series

Relevant Impact

Name: Relevant Impact: A Field Guide to Integrated Assurance
Author: Patrick M. Hayes

A Field Guide to Integrated Assurance

The practical companion volume: how Integrated Assurance is applied inside a working organization, and how impact is judged.

Buy on Amazon →

Where to find it

CRC Press · Publisher edition, hardcover and ebook
Major booksellers · Available through most academic and professional retailers

Published by CRC Press, Taylor & Francis Group.

Overview

Relevant Impact moves from framework to practice. It addresses the question that follows any assurance model, which is how an organization decides what deserves attention when everything can be described as a risk.

The book works through prioritization, ownership, evidence and reporting, with the emphasis on relevance. Assurance activity that cannot be connected to a consequence for the business consumes capacity without improving the organization's position.

It is structured as a field guide, intended to be used during real assessment and reporting work rather than read once.

Who the book is for

Practitioners implementing assurance across functions that were previously separate
Risk and security leaders under pressure to demonstrate meaningful outcomes
Executives who want to judge whether assurance investment is producing insight
Teams preparing assurance reporting for boards and executive committees

Key ideas

Relevance before coverage

Complete coverage of a framework is not the same as understanding the conditions that would threaten the business.

Evidence that holds

Assurance conclusions need evidence that remains valid as the environment changes, not point-in-time attestation.

Ownership as a control

An unowned dependency is a fragility regardless of how well it is documented or monitored.

Reporting that provokes decisions

The purpose of assurance reporting is to change a decision. Reporting that cannot do that is administrative.

Where it sits in the work

Relevant Impact is the bridge between the Integrated Assurance framework and the survivability questions Patrick's current work concentrates on. It is also the source of much of the material behind the Integrated Assurance Maturity Model.