Assurance occupies a privileged position in modern governance. It comes with formality, professional language, and the implied authority of process. Controls are tested, opinions are formed, and statements are signed. For boards operating in complex and regulated environments, this matters. Assurance is not decorative. It exists because organisations need discipline, consistency, and defensibility in how they manage risk.
Most boards therefore treat assurance as a stabilising force. It provides a shared reference point and allows discussion to converge. When assurance is positive, debate narrows and decisions can move forward. When assurance is negative, attention sharpens and corrective action follows. In both cases, assurance supports a sense that risk is being handled within a coherent system.
The difficulty arises not because assurance is misleading, but because it is quietly asked to do more than it is designed to do. Assurance tells us whether something has operated as intended, under the conditions that were assumed when it was designed and tested. What it cannot reliably tell us is whether those conditions are still holding, or whether the assumptions beneath them are beginning to fray.
Boards know this, at least intuitively. Experienced directors will often acknowledge, usually in private conversation rather than formal debate, that a clean assurance opinion does not necessarily mean the organisation is safe. It means that the system behaved properly within its defined parameters. The problem is that those parameters often shift gradually, and assurance rarely identifies that movement until it is well advanced.
This is where comfort sneaks up. Assurance does not merely inform; it reassures. It reduces anxiety by suggesting that risk is bounded, understood, and under control. That reassurance is valuable, particularly in environments where uncertainty is constant and decision-making fatigue is real. Over time, however, reassurance can begin to do quiet work of its own.
The shift is subtle and rarely deliberate. When assurance is provided, discomfort tends to be treated as noise rather than as information. Questions that do not map neatly onto the assurance framework are softened or deferred. Doubts that cannot be substantiated within the language of controls and testing struggle to gain traction. The board does not become complacent, but it does become calmer than the situation may warrant.
When assurance later fails, the failure often feels sudden, even though the underlying dynamics have been developing for some time. A regulatory intervention, a conduct issue, or a loss of confidence appears to emerge from nowhere. The immediate response is almost always to strengthen the assurance regime. More testing, more reporting, more frequent sign-offs. Each of these responses is rational and defensible. None of them, on their own, address the deeper issue.
That issue is not that assurance was wrong, but that it was never designed to detect emerging issues. Assurance is excellent at confirming that yesterday’s system still looks like yesterday’s system. It is far less effective at revealing how that system is adapting under pressure, or how local adjustments are accumulating in ways that may eventually matter.
This creates a familiar pattern. Boards invest heavily in assurance and receive it in good faith. They feel justified in their confidence because the system has told them it is operating as intended. When surprise occurs, the natural conclusion is that the system needs to be tightened. Rarely is the question asked whether assurance has been carrying an expectation it cannot meet.
None of this implies that assurance should be weakened or discarded. On the contrary, boards need robust assurance to meet their obligations and to maintain organisational discipline. The problem arises only when assurance is treated as a proxy for resilience, rather than as one component of it.
Resilience depends not just on whether controls are working, but on whether the organisation is noticing how its context is changing and how its own behaviour is adapting in response. Those questions sit awkwardly alongside traditional assurance because they involve ambiguity, judgement, and partial information. They do not resolve neatly into pass or fail.
When boards rely on assurance to provide comfort, they are often responding to a deeper need for orientation. They want to know whether the organisation still understands the risks it is running, not simply whether it can demonstrate compliance with its own design. Assurance can contribute to that understanding, but it cannot substitute for it.
The uncomfortable conclusion is that boards can be well assured and still poorly prepared. That is not a failure of effort or professionalism. It is a mismatch between what assurance is built to do and what governing under uncertainty actually requires.
If assurance continues to feel comforting right up until it fails, the solution is not to abandon it, nor to demand that it become something it is not. It is to recognise its limits and to supplement it with ways of working that help boards stay oriented as conditions evolve. Comfort, in that sense, should be treated with care. It may be signalling not confidence, but the absence of the questions that matter most.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 12 March 2026 on my Substack.