Last Friday I led a workshop with the IRM Midlands group in Birmingham on a topic that does not get nearly enough practical attention:

Refresh, retire or redesign your internal controls.

It was a really good session.

We had a strong turnout, meaningful discussion, and a room full of people from different industries and different roles across risk management. That mix made it better. Different sectors. Different perspectives. Same underlying tension:

Too many controls survive long after their value has faded.

Some are still there because nobody has challenged them.
Some are still there because they once solved a problem and never got revisited.
Some are still there because evidence feels safer than judgment.

We spoke honestly about all of that.

So first, thank you to everyone who came along. The quality of the discussion was excellent. It gave me plenty to think about on the journey home, and it inspired me to share some of the operating mechanics behind the session, along with a few of the learnings that stood out in the room.

Because this is the real issue.

One of the biggest traps in audit, risk and controls is assuming that because something exists, it must still be useful.

That is rarely tested hard enough.

A control might once have been sensible, proportionate and well designed. But over time the process changes, the risk changes, the systems change, the people change, and the control quietly stays where it is.

Still completed.
Still reviewed.
Still evidenced.
Still reported.

But no longer doing much.

That is how control environments get heavy.

Not through one dramatic mistake.
Through layer after layer of activity that nobody has properly triaged.

And once that happens, you start to see the symptoms:

That is not strong governance.

That is often just control theatre with better filing.

The workshop was built around a simple question:

When you look at a control, should it be refreshed, retired or redesigned?

That framing matters because not every weak control has the same problem.

Some controls are still worth having, but the execution has drifted.
Some controls add so little value that they should be removed or simplified.
Some controls have the right intention but the wrong operating mechanism.

That is why I think this topic matters so much.

Too many conversations about controls start at the wrong end.

They start with testing.
Or evidence.
Or whether the step was completed.

That is backwards.

The better starting point is:

What is this control actually here to change?

If you cannot answer that clearly, there is a good chance the control has already drifted from purpose into habit.

Here is the shortest useful version of the framework.

A control probably needs a refresh when the design is broadly right, but the way it is operated has become inconsistent, unclear or weak.

The intent still holds.
The control still has a place.
But the discipline around it has slipped.

You might see:

In those cases, the answer is not usually to rip it out.

It is to tighten it.

Clarify the owner.
Clarify the trigger.
Clarify the standard.
Clarify what happens when it does not happen.

A control may need to be retired when it has become low-value, duplicative, legacy-driven or simply disproportionate to the risk.

That does not mean weakening the control environment.

It means being honest that some activity survives because it is familiar, not because it is effective.

This is where people often get nervous.

Sometimes retiring a control means removing it.
Sometimes it means consolidating it.
Sometimes it means simplifying a mandatory step that has become bloated.

The point is the same:

less noise, more signal.

A control needs a redesign when the intent is right but the mechanism is wrong.

This is common.

The control exists for a good reason, but it happens too late, sits with the wrong owner, creates evidence instead of challenge, or has become a rubber-stamp step that no longer changes behaviour.

That is not an execution problem.

That is a design problem.

And design problems do not get solved by asking people to try harder.

They get solved by rebuilding the control into the real workflow, at the real point of risk, with a real decision attached to it.

One of the most useful parts of the workshop was the 8-question triage for diagnosing whether a control still deserves to exist in its current form.

I’m including that framework in this issue because it is too useful not to share.

Below is the 8-question triage I shared in Birmingham. I’m only sharing this with workshop attendees and Beyond the Lines™ subscribers because I want this newsletter to keep delivering practical tools you can actually use.

The questions are simple, but they force a much better conversation:

That is the kind of lens that gets you past paperwork and into the truth.

Because a lot of control reviews never get there.

A few themes came through strongly in Birmingham.

One of the encouraging things was that the room did not need convincing that stale controls are a real issue.

People could recognise it quickly.

They knew where reviews had become mechanical.
They knew where sign-offs were happening without much real challenge.
They knew where ownership looked clear on paper but blurred in practice.

That matters.

This came up again and again.

Not whether a control has an owner in a document.

Whether it has a real owner in practice.

That distinction matters more than most frameworks acknowledge.

If the person operating or relying on the control cannot explain what it is meant to change, why it matters, and what happens if it fails, then ownership is weaker than it looks.

And weak ownership is one of the fastest routes to control drift.

This is a big one.

In too many environments, evidence becomes a proxy for effectiveness.

If the file is there, the review happened, the sign-off exists, or the tracker is green, the assumption is that the control must be fine.

But evidence can be very misleading.

You can have immaculate evidence around a control that no longer meaningfully reduces risk.

That is why I keep pushing the same point:

completion is not the same as effect.

This was probably the strongest takeaway for me.

The appetite in the room was not for more abstract control language.

It was for practical mechanics.

How do I know whether this control is still worth keeping?
How do I challenge it constructively?
How do I avoid sounding like I am trying to weaken governance?
How do I simplify without losing protection?

That is exactly the kind of work I want Beyond the Lines™ to do more of.

I’m not trying to build another content brand that just comments on the profession from a distance.

I’m building Beyond the Lines™ to help audit, risk and controls professionals work in a way that is more practical, more commercially aware, and more human.

That means less obsession with control theatre.
More focus on decisions, ownership and outcomes.

It means creating tools, frameworks, working notes and sessions that help people think better, influence better, and improve the operating mechanics underneath the headlines.

It also means building a space where the conversation feels honest.

Because most people in this profession do not need more generic content.
They need sharper language, more useful tools, and better ways to challenge stale practice without creating unnecessary politics.

That is what I’m trying to build.

And sessions like the Birmingham workshop are a reminder of why it matters.

Last week I shared my AI defensibility pack.

It is built for people trying to use AI in audit, risk and controls in a way that is practical, credible and defensible, not performative.

If you missed it, you can get it here:

It sits very naturally alongside this week’s theme, because both topics come back to the same core question:

What actually stands up in the real world?

Pick one control people complain about.

Not the one that sounds most interesting in theory.
The one that causes friction in real life.

Run the 8-question triage on it properly.

Then ask yourself, honestly:

Should this be refreshed?
Retired?
Or redesigned?

That one conversation will probably tell you more than another month of passive compliance ever will.

A control is not valuable because it exists.

It is valuable because it changes something.

If this issue was useful, please share it with a colleague or forward it to someone in audit, risk, controls, governance or finance who would get value from it. That is how Beyond the Lines™ grows, and it really does help spread the word.

And if you were one of the people in Birmingham on Friday, thank you again for making it such a strong session.

There is plenty more to build from here.

And if you want more people to receive practical tools and routines like this each week, share this edition and ask them to subscribe here:

https://beyondthelines.beehiiv.com/

Best,

Tim Buckley

Founder Beyond the Lines™ | Integral Assurance

A labor shortage in tax is driving the need for a new skill set: one that blends technical tax knowledge with digital fluency.

Automation, AI and data-driven insights now define the role of tax professionals.

This new era of tax is not simply about adopting new tools, it’s about reshaping the skill set and mindset required to thrive in this field. Check out this guide for actionable insights into how to cultivate these skills with your team. See how advanced technologies can help bridge the tax tech gap to increase efficiency, ensure compliance, and drive better decision-making.

Download the guide