Trust ≠ assurance

Within large organisations, I see these terms used somewhat interchangeably. The difference likely matters. Let's briefly explore why.

We’ve now established a working defintion for trust that helps guide our focus and orient our actions towards the things we can directly influence as organisations.

‘Assurance’ has a few slightly different, yet related meanings. It also has many uses.

In business, assurance is often a service delivered by an ‘independent’ (this may be somewhat of a pipe dream if you consider some of the issues, conflicts etc. with big professional services firms, which is of course another topic) party or system (technical, legislative etc. An example could be a cryptographic proof for something like ‘identity’. Another example could be something like isotopic analysis for food authenticity), with the goal of improving information quality and ‘verifiability’ so that the parties involved can make a ‘better’, more informed decision (answering questions like, “is this organisation ‘allowed’ to do X in Y context?” or “Does this food meet safety standards for human consumption, export etc.?”).

Using the TIGTech model from Sutcliffe et al. we might consider ‘assurance’ in this context as a series of consistent processes and practices that directly contribute to ‘evidence of trustworthiness’. It’s a ‘feature’ of sorts that may be driven by legislative requirements, but could also be strategically driven by an organisation in their attempt to be more open and accountable to their actions (it’s usually the former).

Sometimes folks think that assurance = certainty. It does not. It’s a representation of real world events that helps guide and inform.

So what’s the relationship between trust and assurance, given we now understand the very basic gist of their meanings in this context?

The image below created by Julie Bang - contained in Trust Over IP's Design Principles document - can help us clarify.

To the furthest right of the normal distribution is a theoretical scenario where a party (in a sample of one situation for the purpose of this current example) needing to make a trust-based decision has perfect information at their disposal. Given that this is never the case (epistemologically or practically speaking), and that parties always need to make decisions in environments of uncertainty / probability, trust becomes relevant.

Trust makes the positive decision and action possible (or not), even without all of the information (many like to think about trust as being the bridge that closes the uncertainty gap and leads to positive action. Rachel Botsworth’s definition is often called upon in this context).

The closer one gets to full or 'perfect' information (the result of 'evidence of trustworthiness' in the model we use), and thus 'absolute assurance', the more confident one can be in the accuracy of expectations and the future delivery of value aligned to those expectations (key considerations in the mental process that leads to a trust judgement).

In my work I like to consider assurance systems (pushing aside their various regulatory associations for a moment) as enablers of evidence of trustworthiness. They contribute to scrutiny, help hold certain parties to account and can produce information that is then made available to help other parties decide whether or not a party is worthy of their trust in a given context.

As with most of my recent posts, this is the lightest version of a 101 on the topic. If you’re interested in the deeper view, let me know. If you want me to keep the short posts coming, show some support by choosing to…