Combined assurance

The Board, supported by the Audit Committee, is ultimately responsible for Blu Label’s system of internal controls, which has been designed to evaluate, manage, and provide reasonable assurance against material misstatement and loss. The Audit, Risk, and Compliance Committee (ARCC) of Blu Label is specifically responsible for overseeing the effectiveness of combined assurance arrangements within the organisation, which is documented within the Blu Label Integrated Risk Assurance Policy and Framework. The Internal Risk and Compliance Committee (IRCC) is responsible for directing and assisting in the co-ordination of the combined assurance arrangements within Blu Label as well as ensuring that a robust integrated risk assurance plan is compiled and executed by the various assurance providers on an annual basis.

Blu Label has adopted a combined assurance model, in line with corporate governance objectives, to optimise assurance obtained from management, corporate functions, and internal and external assurance providers on business risks. The combined assurance model is integrated within the risk management process, including reporting to and oversight from the IRCC and ARCC, from which the annual integrated assurance plan is developed in respect of the priority risks for the Group across the four lines of defence (Management, Compliance, Independent Assurance, and Oversight Committees) through defined assurance activities. The assurance plan is a key tool to support the ARCC and the Board in making its endorsement on the effectiveness of internal controls in the integrated report and to support the integrity of information that underpins internal decision‑making within Blu Label and reporting to its stakeholders.

Various meetings were held during FY25 between Internal and external audit to understand scope, nature, timing and extent of audit testing.

Both internal and external audit are in agreement on the importance of combined assurance and the need for productive discussions to align the scope and timing of audits.

FY25 ACTIONS PERFORMED:

• External audit reviewed the FY24 internal audit work performed as input into their FY25 planning considerations as well as the FY25 Oracle Post Implementation Review. Reliance was however not placed on the work performed by internal audit due to timing and scope differences, as well as the extent of testing performed.

FY26 PLANNED ACTIONS:

• The external audit methodology requires 20% re‑performance of the internal audit work. Internal audit will share the required artefacts accordingly.
• To aid in efficiency and reduce duplication of efforts, inviting external auditors to internal audit engagement planning and walkthroughs will be proactively performed in FY26. This will be performed for internal audit reviews where there is a shared interest.
• Audit work plans for Internal and external audit will be shared among each other to foster better collaboration for FY26 and beyond.

In conclusion, risk audits are assigned to appropriate assurance providers, who monitor the effectiveness of the action plans and processes developed and implemented by management to mitigate the risks. This model gives the Board the assurance, through the ARCC, that all significant risks and associated opportunities are adequately managed.

All stakeholders, from a combined assurance perspective, are committed to increase the level of collaboration and reliance in FY26.