Step 4. Obtain Independent Third-Party Assurance on Supply Chain Due Diligence Practices

The independent assurance provides the Board, LBMA and external stakeholders with the comfort that the Refiner’s supply chain due diligence policies and processes are appropriately designed, and are effectively operating to meet the objectives of the RGG and to protect gold supply chains against the material threat of finance risks and ESG factors.

4.1 Assurance requirements

Assurance Provider independence and competency

The Board Committee is responsible for the approval of a third-party Assurance Provider, and must ensure that it is independent of the organisation and has the requisite competencies, experience and capacity to carry out the engagement. LBMA has aligned assurance independence requirements to the EU mandatory audit firm rotation12 and Refiners must rotate Assurance Providers every ten years on a comply or explain basis, subject to LBMA approval. Where audit firm rotation is not a viable option, the Refiner should at a minimum rotate the Assurance Partner responsible for signing off on the engagement.¹³

LBMA undertakes a rigorous Assurance Provider approval and monitoring process, and Refiners must select an Assurance Provider from the Approved Service Providers List (available on www.lbma.org.uk).

Assurance objective

The Assurance Provider is expected to express a conclusion on whether the Refiner’s annual reporting (refer to Step 5 of this Guidance) fairly describes the Refiner’s activities and on the Refiner’s management’s overall conclusion on meeting the objectives of the RGG. It is designed to enhance the intended users’ degree of confidence in the Refiner’s public Compliance Report and the confidential Country of Origin Annex.

Refiners must grant Assurance Providers the requisite access to relevant sites, personnel, documentation (including previous years’ management reports) and data in order for them to perform their duties.

Assurance standards

LBMA will only accept an assurance engagement performed in accordance with the ISAE 3000 revised assurance standard. A reasonable level of assurance should be carried out in year one of implementation or appointment of new Assurance Provider. Refiners may select a limited level of assurance for the next two years only if medium-risk or high-risk, or indeed zero-tolerance non-conformances are not identified during the reasonable or limited assurance engagements. Reasonable assurance is mandated every three years; however, Refiners may choose this level of assurance each year. The required assurance frequency should increase if instances of non-conformance are identified or if there is a significant change of circumstance in the Refiner’s supply chain.

Note 4: Consistency in assurance deliverables

Assurance Providers are expected to ensure sufficient transparency and consistency in the information presented in both the Refiner’s reporting and the assurance deliverables to meet the users’ needs. For example:

• For an unqualified Assurance Report, the Compliance Report cannot conclude full compliance with the RGG when medium-risk and high-risk assurance non-conformances have been raised
• The Assurance Report should draw attention to the medium-risk and high-risk assurance non conformances identified (either in the Assurance Report itself or in disclosures in the Refiner’s Compliance Report).

Further detail is provided in the Third-Party Assurance Guidance.

Submission of assurance deliverables to LBMA

Copies of all three deliverables should be submitted by the Refiner, or the Assurance Provider as designated by the Refiner, to the LBMA Chief Executive via email on an annual basis and within three months of the financial year end. Assurance Providers and/or Refiners may apply for an extension should this not be feasible due to unforeseen circumstances.