Assure: assured, not just reassured

Anissa Levy · 2 November 2026 · Part 3 of 3: Design. Transform. Assure.

In Part 1 of this series, I wrote about designing the regulator the mandate needs. In Part 2, about one coherent roadmap to get there. Part 3 is how you know it’s working.

Take a good, hard look in the mirror

Answering that question well means taking a good, hard look in the mirror. Not at what the policies say, or what the last report said, but at how the regulator actually works day to day, including the parts that are uncomfortable to see.

That’s harder than it sounds. Every organisation has a version of itself that lives in its strategies, frameworks and annual reports. The real test is whether that version matches what staff, regulated parties and the community experience.

Assured, not just reassured

Assurance is often treated as a check at the end: an audit, a review, a rating to report and file. Too often, it leaves leaders reassured rather than assured.

Reassurance comes from reporting that says things are on track. Assurance comes from evidence that they are, and an honest picture of where they’re not.

The difference matters. Leaders who are only reassured find out about problems late, often from an external review, an incident or a headline. Leaders who are assured have the information to act while there is still time.

More than a score

Done well, assurance gives leaders more than a rating. I think of it in three steps:

1. Assess maturity. Understand where the regulator sits, using evidence rather than perception alone. Test self-assessments with the people doing the work and those affected by it.
2. Diagnose causes. Ask why a gap exists. Is it about systems, capability, governance, culture or resourcing? Fixing a symptom without understanding its cause means the same issue comes back.
3. Plan action. Prioritise a realistic set of improvements, assign clear ownership and track them through to outcomes, so the next assessment shows genuine progress.

From findings to follow-through

Assurance only creates value when it leads to decisions, ownership and follow-through. Too many reviews produce sound findings that are accepted, filed and only revisited when the next review finds the same issues.

When assurance is connected to the regulator’s design and its transformation roadmap, it becomes part of how the organisation learns and improves. That’s what turns findings into continuous improvement, and gives leaders, boards and the community real confidence that the regulator is getting better at what matters.

That’s the series: Design the regulator the mandate needs. Transform it through one coherent roadmap. Assure that it’s working, and keep improving.

Stop fixing symptoms. Start fixing systems.