ASSURANCE TO ACTION FOR INTERNAL AUDIT, RISK & CONTROLS LEADERS
ISSUE 054 • 27 OCTOBER 2026 • 2027 PLANNING SPECIAL • 8 MIN READ
━ ━ ━
Hi {{name|there}},
It’s October, and your 2027 planning is probably already well under way. Before the diary fills and the budget settles, this feels like a useful moment to pause.
This week, I’m sharing Before You Sign Off Your 2027 Internal Audit Plan: a year’s worth of BTL conversations, client work and shared experience, brought together in one practical paper.
If you work in risk, controls or finance, there is plenty here for you too.
YOUR FREE COPY
17 pages. 12 points for consideration. 22 linked sources.
Questions to ask, evidence to look for and illustrative audit scopes to bring into your planning discussion.
BEYOND THE LINE
Before you sign off your 2027 internal audit plan
Why I made this
Across client work, the Leadership Signals webinar series, BTL content and conversations at conferences, I hear questions that may never reach every team’s planning meeting. Questions about who really owns an AI decision, whether a fallback would work, or whether all our control and assurance effort is going to the right places.
I wanted to bring those questions together while there is still time to change a scope, bring work forward or budget for the skills it will need.
What went into the paper
I went back through my personal notes, LinkedIn posts and replies, 35 newsletter articles, existing BTL guides and anonymised practitioner discussion summaries year to date. Client work, Leadership Signals and conference conversations helped shape the practical viewpoint.
I grouped the recurring questions, checked selected claims against professional and regulatory sources, and turned the themes into points you can put beside your own plan.
The topics range from AI leadership, hidden use and cost to wider testing, cyber impersonation, critical services, suppliers and assurance coverage. They also cover material controls, culture, people, business change, data, privacy and regulatory readiness.
Each point asks what matters, what evidence would help and who owns the response. Illustrative audit titles and scopes make the questions easier to use.
The value is in the planning discussion it helps you have. You may spot a gap, challenge an assumption or make work already planned more useful. You may also decide that your current coverage is sound.
WHAT CHANGES
Start with the question your plan needs to answer
01 · Coverage. Does the planned scope test the important decision, including the handoffs between teams?
02 · Timing. Will the answer arrive while management can still act on it?
03 · Capacity. If the work needs to change, what time, skills or specialist support will make it possible?
PUT IT TO WORK
Use one point to improve one planned audit
Work through this with your draft plan open:
Pick one relevant point in the paper. Choose something that matters to your organisation, such as how people review AI output.
Find the audit that should cover it. Read the planned scope. Would the work answer the question raised in the paper? If no planned audit covers it, record the gap for your planning discussion.
Decide what needs to change. You might add a test, bring the review forward or get specialist help. If coverage is already sound, keep it.
For example: your AI governance audit might check policies but never test whether people challenge AI output. Add a walkthrough of one real AI-assisted decision and inspect the review evidence. Who reviewed it, what did they check and could they reject or override the output?
Write down the change, why it matters, the evidence you need and any extra time or skills. Take changes through your normal approval route.
ACROSS THE LINES
Why this is useful beyond internal audit
Risk teams: use the questions to challenge assumptions, connect exposures and identify where better evidence would help a decision.
Controls teams: use them to examine ownership, workarounds, control cost and whether the response actually protects against the risk.
Finance and business leaders: use them to discuss data, AI investment, supplier resilience, material controls and the people needed to deliver change.
The paper is written around audit planning, but these are shared business questions. You do not need to own the audit plan to bring a useful challenge to it.
IN THE ROOM
ICAEW Annual Conference: better work, with better judgement
I had a really enjoyable day at the ICAEW conference, with some great discussions and a chance to catch up with friends and familiar faces. One of the highlights was Hannah Fry’s keynote on AI.
A few things really stuck with me:
AI is changing how we develop people. If junior auditors can get answers in seconds, how do they build the experience and judgement they used to pick up by working alongside others? We need to rethink how we teach, not just what tools we give them.
Human in the loop is important. Human in the lead is equally important. However autonomous AI agents become, accountability still sits with people.
The economics still need to work. Spending £100 on AI tokens to solve a £20 problem probably isn’t the transformation we’re looking for!
There was plenty to think about around continuous auditing, AI governance and the future of our profession. For 2027 planning, I’d bring those conversations back to team skills, the quality of human review and whether the work is worth the time and cost.
The opportunity isn’t just to do more work with AI. It’s to do better work, with better judgement.
PLANNING QUESTIONS, ANSWERED
Eight common questions about 2027 audit planning
What should a 2027 internal audit plan cover?
Bring together business objectives, significant risks and change, the questions leaders need answered, and audits required by applicable laws or regulations. Confirm required coverage and deadlines with compliance or legal colleagues. Consider existing assurance, previous findings, resources and any important gaps.
Is October too early to challenge the 2027 plan?
No. Use this pause to test scope, timing and resources before budgets settle. Work backwards from business decisions and regulatory deadlines, and keep the plan open to change.
Does every point need a separate audit?
No. You might adjust an existing review, run a focused test or use advisory work, project assurance or training. These options do not replace audits you are required to undertake. Protect required coverage, agree appropriate safeguards and keep management responsible for its decisions.
Does the paper replace our planning methodology?
No. Use it alongside your methodology, risk assessment and applicable obligations. It provides questions to challenge the plan, rather than an exhaustive risk list or confirmation that coverage is complete. The IIA’s risk-based planning guide provides supporting guidance.
How do I know whether my team has the skills?
For each review, list the skills needed, who has them and who can supervise the work. Check recent experience and work quality, alongside qualifications. Identify gaps early and choose training, supervised practice or specialist support. Allow for the time those options need.
Who should I speak to before seeking approval?
Speak with business leaders and the people closest to the risks, including finance, risk, compliance, controls and IT. Compare coverage with other assurance providers. Discuss priorities and resource gaps with senior management and the audit committee chair. The audit committee typically approves the plan, under the authority delegated to it by the board.
Keep those conversations going after approval. Review the plan when risks, business priorities or regulatory requirements change. Explain any work you add, defer or remove, and the effect on coverage and resources. Agree what counts as a significant change and take those changes back to the audit committee for approval.
Further reading: IIA Standards 9.4 and 9.5 cover stakeholder input, plan updates and coordination with other assurance providers. The IIA’s risk-based planning guide provides further practical guidance (member download).
How do I ask for more budget?
Show what the extra money enables: the review, skills or earlier answer needed, its cost and the coverage gap it closes. Compare options, such as reprioritising work, training or specialist support. Present a recommendation and the consequences of staying within the existing budget. Make coverage limitations clear to senior management and the board.
How do I start auditing AI if it is new to me?
Find out where AI is used, who owns it and which decisions it affects. Choose one clearly defined business use. Start with governance, data handling, approvals and human review, supported by The IIA’s AI Auditing Framework. Bring in specialist skills where needed. A governance review does not establish that a model is technically reliable.
BTL TOOLBOX
Take the paper into your next planning discussion
I’d encourage you to give this a proper read with your draft plan beside it. Mark the points that matter to your organisation and take one useful question to your next team discussion.
You can also share it with the risk, controls and finance colleagues who help shape the work. A useful result might be a better scope, an earlier review or a clearer decision about capacity.
WORKING WITH BTL & INTEGRAL ASSURANCE
Budgeting for the work behind the plan
BTL and Integral are now working with clients across the UK, USA, Europe and Middle East. The work spans professional scepticism, evidence challenge, clearer executive messages, control impact, action closure and human judgement with AI, through practical workshops, team development and bespoke advisory and implementation. What connects it all is helping teams make sound judgements, give leaders something useful to act on and build clearer ownership. Those conversations and practical challenges continue to shape what I share here.
Beyond the Lines™ supports practical team learning through focused workshops and the six-month Assurance Impact Partnership.
Integral Assurance provides bespoke advisory and implementation support, including audit planning and delivery, financial controls, assurance mapping, remediation and change assurance.
If you’re setting 2027 budgets, reply with the priority, who needs support and the timing. We can talk through what would be useful.
YOUR VIEW
Have a useful lesson to share?
I’m always interested in practical guest contributions from people working in audit, risk, controls or finance. A planning decision, a lesson from a difficult piece of work or a method others could use would fit well.
Reply with a few lines about the idea. No finished article needed. Keep examples anonymised and share only material you have permission to use.
SOCIALS
Follow along between editions
I’ve just launched my Instagram page, @timbuckleyaudit. If you find BTL useful, I’d appreciate a follow there and on LinkedIn, and a subscription to the Beyond the Lines YouTube channel.
ONE LAST LINE
The most useful change to your plan may start with a better question.
Best regards,
Tim Buckley
Founder, Beyond the Lines™
Know someone who would find this useful? Forward this edition. They can subscribe to Beyond the Lines here.