This one is about a simple but uncomfortable idea:
If your 2026 audit, risk and controls year looks like 2025 with “AI” sprinkled on top, it’s already out of date.
The world you’re operating in has moved.
Your plans, controls and assurance need to move with it.
To help, I’ve created a new free tool:
👉 2026 Risk & Controls Planner – a planning workbook to design your year around the reality you’re in, not the theatre you present.
In this edition I’ll walk you through:
Why “same plan, new year” quietly kills impact
How to run the Operating Reality Check (Step 1) with your team
How to choose 3–5 critical areas that actually matter (Step 2)
A simple first 90 days rhythm and how AI fits (Step 3)
Concrete ways to use the planner with your team in January
If you lead or influence audit, risk or controls, this is designed to be something you can literally print and use next week.
1. The “same plan, new year” trap
Most teams start the year like this:
Pick up last year’s audit / risk plan
Move a few pieces around
Add some words about AI, cyber, resilience
Call it “refreshed”
Underneath that, three things are usually true:
The environment has shifted faster than the plan.
Systems, structures, products, regulators, third parties – all moving at a different speed.People are tired.
Burnout, restructures, vacancies, extra “special projects” quietly absorb the capacity the plan assumes you still have.Controls are still built for a slower world.
Manual checks, heroic spreadsheets and end-of-period fire drills – in environments that now run at automation speed.
That’s how you end up with:
A beautiful plan that doesn’t match the year you’re actually about to live through
A control environment that works in slides but cracks under real pressure
Teams spending more time maintaining the plan than managing the risk
The planner is my answer to that:
Three steps to force an honest conversation upfront.
2. Step 1 – Operating Reality Check: “The world we’re actually in”
Step 1 has four lenses:
1️⃣ Change & velocity
2️⃣ People & capacity
3️⃣ Data, tech & AI
4️⃣ Culture & ownership
It’s deliberately simple. The value comes from what you write on it.
How to run Step 1 (90-minute workshop)
Grab:
You (audit / risk / controls lead)
1–2 people from the first line (operations / finance / tech)
Someone who “is in the know about the dirty laundry” process-wise
Print Step 1 or screen-share it.
For each lens, ask:
“What’s really true here – not the polite version, the real one?”
Example prompts and real answers I often hear:
1. Change & velocity – “Where is the ground moving?”
Prompts you’ll see on the planner:
What are the biggest changes coming in 2026?
Where did 2025 surprise us?
Where is change moving faster than our control design?
Typical honest answers:
“We have two major system changes and a restructure landing in the same six months.”
“We’re launching new products faster than we’re updating our controls.”
“We still treat change like an exception, not the norm.”
Your one-line summary might be:
“2026 is a high-change year being planned with a low-change mindset.”
That single line is dynamite when you later challenge the plan.
2. People & capacity – “Who is carrying this, at what cost?”
Prompts:
Where are teams stretched or burned out?
Where are we one resignation away from a problem?
What work feels like noise?
Honest answers you might see:
“Two key finance people are covering three roles.”
“Risk and audit are both down headcount but our plan hasn’t moved.”
“Our most experienced people are stuck firefighting instead of designing better controls.”
You might summarise:
“Our 2026 plan assumes more capacity than we actually have.”
3. Data, tech & AI – “What can we actually see?”
Prompts:
Where are we still winging it?
Where is automation / AI already in the flow?
Which decisions depend on data we don’t fully trust?
Real-world answer:
“We say we’re ‘data-driven’, but key reconciliations are still on Excel.”
“Teams are quietly using GenAI tools but there’s no joined-up view.”
“We use dashboards but nobody trusts the source definitions.”
Summary line:
“We are using AI and automation on top of data and controls we don’t fully trust.”
4. Culture & ownership – “How do people actually behave?”
Prompts:
Where is challenge safety fragile?
Which risks belong to “everyone”?
Where are we relying on heroics?
You might hear:
“People still feel safer staying quiet than challenging timelines.”
“No one really owns third-party risk – it’s spread across three teams.”
“Most key processes still run on ‘Sandra knows how it works’.”
Summary line:
“We rely heavily on individual heroes in a culture that still punishes challenge.”
If Step 1 makes you slightly uncomfortable, that’s good.
You’ve just captured your real starting point.
That’s the world your 2026 plan needs to make sense inside.
3. Step 2 – 2026 Focus Map: “If this breaks, we’re in trouble”
Step 2 stops you trying to fix everything.
You pick 3–5 “if this breaks, we’re in real trouble” areas and go deeper on each.
Examples might be:
Group cash and liquidity
Revenue recognition in one key business unit
Access and identity for a critical platform
AI model governance for a flagship use case
Third-party risk for your biggest suppliers
For each, the planner guides you through four questions.
Let’s walk one through so you can see how it works.
Example: Critical Area – AI model governance
1. Name of area, risk or process
“AI model governance for our core customer-decisioning models.”
2. What are we really trying to protect?
“Customers, fairness, regulatory compliance and our reputation if decisions are challenged.”
3. Current reality – not the policy version
You might write:
“We have a governance paper and a model policy, but practice is patchy across teams.”
“Monitoring happens quarterly … if there’s capacity.”
“Most insight lives in one or two technical experts; little is documented in business language.”
4. Biggest fragilities / risks
Examples:
“Looks controlled in documentation, but monitoring is inconsistent.”
“If our key expert leaves, we would struggle to explain decisions to a regulator.”
“Evidence of challenge and override is limited and hard to extract.”
5. One meaningful move for 2026
Tick a box and commit to something real:
✅ Clarify ownership – formal model owner in the business, not just data science.
✅ Automate evidence – build a standard monitoring pack that runs monthly, not just before audits.
✅ Improve the story – define a simple “how this model works and what could go wrong” briefing for senior leaders.
You might write:
“By June 2026, this model will have a named business owner, monthly monitoring pack, and a one-page explanation we’d be comfortable sharing with a regulator.”
That’s a tangible move.
Repeat this for 3–5 areas.
At the end you should have a small set of big moves you can anchor your year around.
4. Step 3 – First 90 days and using AI well
Step 3 is where the planner turns into a Q1 plan.
Think of it as your minimum viable transformation.
Weeks 1–2 – Make the reality visible
Complete Step 1 with your core team.
Agree your one-line reality summaries.
Share them with your sponsor / leadership and ask: “Does this feel honest to you?”
If the answer is “no”, you’ve already started a useful conversation.
Weeks 3–4 – Refocus your 2026 plan
Take your existing plan and, with your planner next to it, ask:
What in this plan clearly responds to the reality we’ve written down?
What looks like historical habit?
What have we promised that we cannot deliver with current capacity?
Then rewrite your top 5 priorities like this:
From: “Audit of third-party risk framework”
To: “Give the board a clear view of our top 10 third-party exposures and the 3 biggest fragilities in how we manage them.”
From: “Annual review of model governance”
To: “Ensure our flagship AI use case can be explained, defended and evidenced if challenged by a regulator.”
Same topics. Different level of clarity and bite.
Weeks 5–8 – Redesign 2–3 key controls
Pick two or three areas from Step 2:
Get the people who actually do the work together (not just owners).
Map how the control happens today: step by step.
Circle:
manual workarounds
late-night end-of-month heroics
confusing or duplicative steps
Then ask three questions:
What is this control really here to do?
How could we make the right behaviour easier and more obvious?
How could we generate the evidence automatically as part of the process?
Your goal is not perfection; it’s one meaningful redesign you can implement early in the year.
Weeks 9–12 – Bring AI into the loop (deliberately)
On the planner you’ll find five AI prompts.
These are designed to work with enterprise approved tools like ChatGPT, Copilot, etc.
For example, you can:
Paste in your Step 1 notes and 2026 plan and ask for a misalignment analysis
Paste in a messy control description and ask for design principles to simplify it
Paste in your evidence model and ask: “Where are we still relying on screenshots and emails, and what could we automate?”
Important:
AI is there to surface options and hidden spots, not to decide for you.
Use it as a thinking partner.
Then apply your own judgement about what fits your context and risk appetite.
5. How to actually use this planner (and get value, not just a PDF)
A few practical ways subscribers can use this in January:
Option A – Leadership working session (2–3 hours)
Participants: CAE / CRO / Head of Controls, plus finance / ops / IT leads.
Agenda:
Complete Step 1 together.
Agree 3–5 “if this breaks, we’re in trouble” areas.
For one area, complete the full block on Step 2 in the room.
Agree the first 2–3 moves for Q1.
Outcome:
A shared, honest view of 2026 and a small set of actions that reflect it.
Option B – Team exercise at your January kick-off
Send the planner to your team in advance.
Ask each person to fill Step 1 from their perspective.
In the meeting, compare answers:
Where do we agree?
Where are we seeing different realities?
You will quickly see:
Hidden spots
Assumptions
Hidden pockets of fragility
Option C – Personal sanity check if you don’t have buy-in (yet)
If you can’t get sponsorship:
Fill the planner yourself.
Use it to quietly challenge:
your own 2026 priorities
the amount of work you’ve accepted
the controls you choose to focus on in your role
You don’t need permission to plan your effort around reality.
6. Your next step
If you want to turn this edition into something tangible:
👉 Download the 2026 Risk & Controls Planner
and block 60 minutes in your calendar this month to complete Step 1 with at least one other person.
Then hit reply to this email and tell me:
One sentence from your reality check that surprised you
One “big move” you’ve chosen for 2026
I will reply with my take, and use all of your feedback for future editions.
Sneak peek: next edition
In the next issue, we’ll dig into:
Designing controls that work at real-world speed
How to move from heroic manual controls to evidence-by-design, without overwhelming everyone with process.
We’ll look at:
Red flags that your controls are built for the wrong speed
Design patterns that turn controls into enablers, not obstacles
Real examples you can adapt inside your own environment
Thanks, as always, for reading and for the work you do.
Here’s to a 2026 with more truth, and control environments that actually match the world you’re operating in.
See you in the next edition,
Creator Beyond the Lines™