I’m Tim Buckley, and this is the weekly Beyond the Lines™ newsletter.

Beyond the Lines™ is built around a simple belief: internal audit and wider assurance work should help organisations make better decisions, not just produce better documentation.

That means moving beyond control theatre and focusing on the things that actually create trust: clear ownership, useful governance, decision-ready reporting, commercial consequence and follow-through.

AI can help with the mechanics. But judgement, challenge and accountability still sit with people.

This week’s edition is about something that sounds operational, but is actually deeply strategic.

Operating mechanics.

That might not sound as attractive as executive presence, storytelling or strategic influence. But in practice, a lot of leadership credibility is built through the way a function runs.

Not the slogans.

The rhythm.

The cadence of follow-up. The quality of escalation. The discipline in the ARC paper. The clarity of ownership. The way management actions are tested. The ability to keep important issues moving after the report has been issued.

Because strong internal audit leadership is not just about sounding credible in the audit committee meeting.

It is about creating enough operating discipline before and after the meeting that people trust your function to know what matters, what is moving, what is stuck and what needs a decision.

That is the bit many teams underinvest in.

Many internal audit functions are incredibly busy.

The audit plan is full. Fieldwork is moving. Reports are being issued. Actions are being tracked. Stakeholder meetings are in the diary. ARC papers are being prepared. Emerging risks are being discussed.

On the surface, the function looks active.

But activity is not the same as influence.

The harder question is whether all that work is actually changing decisions, ownership or outcomes. Did the audit change what management did? Did it surface a trade-off the business needed to face? Did it create a better audit committee conversation? Did it make ownership clearer? Did it reduce exposure? Did it change behaviour?

That is a difficult thing to admit, because audit teams are often working hard. But this is not about effort. It is about operating design.

A team can produce good work and still lose influence if the rhythm around that work is weak.

Issues drift. Actions become administrative. Ownership looks clear in the tracker but weak in practice. Escalation arrives late. Papers describe activity rather than judgement. Audit committee conversations become updates rather than decisions.

That is not usually a technical audit problem.

It is an operating mechanics problem.

Operating mechanics can sound like process hygiene. In reality, they send powerful leadership signals.

A weak cadence tells management that important issues can drift. Loose ownership tells people accountability is negotiable. Poor paper discipline makes the audit committee work too hard to find the point. Late escalation makes challenge feel personal rather than designed. Weak follow-through suggests the report mattered more than the outcome.

None of those signals are neutral.

They shape how the function is perceived.

A board-trusted internal audit function does not just produce assurance. It creates movement. It helps the organisation see what needs attention, who owns it, what decision is required and what happens if nothing changes.

That is why the operating model matters. Not in the theoretical sense of structure charts and methodology documents, but in the practical sense of how work moves through the system.

The best CAEs do not only ask, “Have we delivered the audit plan?”

They ask better questions.

A board-trusted internal audit function needs five operating layers.

Not as a theoretical model. As a practical way of running the function.

Cadence is the rhythm by which important issues move.

Not everything should wait for the next audit committee meeting. Some matters need weekly traction. Others need monthly challenge. Some need quarterly ARC visibility. A few need immediate escalation because the risk has changed or the management response is not good enough.

Weak cadence creates drift. The action remains open, but no one feels urgency. The deadline moves, but the consequence is not discussed. Management agrees in principle, but the operating decision is never made. The audit committee sees the issue later, when the useful window for challenge has narrowed.

Strong cadence prevents that.

It creates a rhythm for movement.

That is not bureaucracy. It is leadership discipline.

A name in an action tracker is not ownership.

A job title in a management response is not ownership.

Real ownership means the accountable person can explain what will change, why it matters, what decision is needed, what dependency exists, what trade-off is being made and how they will know the issue is genuinely fixed.

This is where many control environments quietly fail.

Everything looks fine on paper. The action has an owner. The deadline has been agreed. The wording sounds reasonable. But the operating reality is weak.

No one has agreed the process change. No one has dealt with the dependency. No one has made the funding decision. No one has clarified the hand-off. No one has built the rhythm to test whether the action has reduced the risk.

Internal audit should not own management’s action. But it should be very good at testing whether management ownership is real.

A simple ownership test is this:

Can the owner explain the decision, the change, the consequence and the evidence?

If not, the action may be documented, but ownership is not yet mature.

Escalation should not be theatrical. It should be designed.

If escalation only happens when everyone is already frustrated, it becomes personal. If escalation criteria are clear, it becomes part of the operating model.

Useful escalation triggers might include repeated missed deadlines, unclear ownership, increased exposure, no interim mitigation, disputed risk acceptance, actions closing without evidence of impact or management responses that do not match the seriousness of the issue.

The point is not to escalate everything. That destroys trust.

The point is to make escalation predictable, fair and linked to consequence.

This protects the CAE from two common traps: being too passive, so issues drift, or being too reactive, so challenge feels political.

A clear escalation rhythm makes the function easier to trust.

Audit committee papers are not storage containers. They are decision tools.

That distinction matters because too many ARC papers describe activity when they should sharpen judgement.

A weaker paper says: here is what we did, here is what we found, here is the action status, here is a long table and here are several pages of supporting detail.

A stronger paper says: here is what has changed, here is what has not moved, here is where ownership is weak, here is the risk being carried, here is the commercial consequence and here is the challenge or decision the committee may need to make.

The audit committee does not need every detail. It needs judgement.

This is especially relevant for advisory work. A BtLsubscriber recently raised a good question about unrated advisory reports and whether they should be rated. My view is that the rating is not the main issue.

The real question is whether the report creates enough clarity about the decision, risk, ownership and action required.

Some advisory reviews should not be forced into a traditional rating model if that rating creates false precision. But advisory work still needs discipline. It still needs a clear conclusion. It still needs management ownership. It still needs agreed next steps. It still needs a view on consequence. It still needs a way to show whether anything changed.

The meeting is not the end of the work.

In many organisations, the real control weakness appears after everyone has agreed in principle. The minutes are written. The action is logged. The owner nods. The deadline is accepted.

Then momentum fades.

This is where internal audit credibility is tested.

Not because internal audit owns the action. It does not.

But because internal audit should know whether the issue is genuinely moving or merely being tracked.

There is a big difference between these two updates.

Weak update:

“Action overdue. Management revised deadline to Q3.”

Better update:

“The action remains overdue because the accountable operating owner has not agreed the process change. Current exposure remains open across three regions. Internal audit recommends ARC challenge management on ownership, timeline, interim mitigation and consequence.”

Same issue. Different leadership signal.

One tracks administration. The other explains the operating blockage and why it matters.

That is the difference between action tracking and management traction.

Most internal audit leaders know this situation.

You have a finding that is valid. Management does not fully disagree, but they do not really move either.

They say the issue is more complicated than audit understands. They point to competing priorities. They accept the action but water down the wording. They revise the deadline. They say the risk is already being managed informally. They do enough to keep the tracker moving, but not enough to change the underlying issue.

This is where communication matters.

But not in the vague sense of “be more influential”.

The operating mechanics matter too.

Instead of repeating the finding louder, reframe the conversation around four questions:

That moves the conversation away from whether the finding is annoying and towards ownership, consequence and evidence.

A useful line might be:

“We may be aligned on the issue, but I do not think we are yet aligned on the operating decision needed to fix it. From our view, the unresolved decision is who owns the process change, what interim mitigation is acceptable and what evidence would show the exposure has reduced. Can we agree that before we finalise the response?”

That is a very different conversation from chasing wording in an action plan.

Another BtL subscriber question touched on reviewing the work of a strategy department.

This is a good example of where operating mechanics are more useful than checklist thinking.

A weaker review would ask whether there is a strategy document, whether it was approved, whether there is a governance forum, whether KPIs are tracked and whether minutes are retained.

Those questions may be relevant, but they are not enough.

A better internal audit review would ask how strategic choices are made, what trade-offs are visible, how assumptions are challenged, how the strategy links to capital, capability and risk appetite, what happens when performance signals show the strategy is not working and who owns corrective action.

It would also ask whether the board pack shows decision-quality information or just progress updates.

That is the difference between auditing artefacts and auditing operating reality.

The same principle applies across audit work.

Do not just ask whether governance exists.

Ask whether it improves decisions.

Governance is not meant to slow everything down. It is meant to make decisions better.

But in many organisations, governance becomes confused with activity. More committees. More papers. More standing agenda items. More action logs. More people copied in. More updates “noted”.

That can create the appearance of control, while actually creating friction.

Useful governance should make clear what decision is needed, who owns it, what risk is being accepted, what trade-off is being made, what needs escalating and what happens if nothing changes.

Internal audit has a valuable role here because it can see where governance is not creating flow.

Issues bounce between committees. Papers are noted but not acted on. Actions are accepted without ownership. Decisions are deferred without consequence. Management updates describe activity rather than movement.

A simple test:

Did this governance forum move a decision, ownership or outcome?

If not, it may be governance theatre.

AI can help internal audit improve some of these mechanics.

It can summarise management updates, identify repeated slippage, compare action wording across reports, draft clearer issue summaries, organise evidence, structure ARC papers and spot patterns across open findings.

That is useful.

But the judgement remains human.

AI drafts. Humans decide. AI organises. Humans validate. AI speeds up mechanics. Humans sign off.

That distinction matters because the aim is not to automate accountability away. The aim is to make accountability easier to see.

A future-ready audit function will use AI to reduce the administrative drag around reporting, tracking and summarising. But the premium will sit in human judgement: what matters, who owns it, what consequence remains, what the audit committee needs to know and what conclusion can be defended.

That is where internal audit leadership will continue to matter.

Pick one important open issue.

Not the whole audit plan. Not ten actions. One issue that matters.

Then work through these questions.

Decision
What decision is needed next? Has that decision been made, delayed or avoided? Who has the authority to make it?

Ownership
Who is the real owner? Can they explain what will change? Are they accountable for the outcome or only the action?

Consequence
What happens if nothing changes? Is the consequence operational, financial, regulatory, customer-related, reputational or cultural? Has that consequence been made visible?

Evidence
What would prove the issue is genuinely fixed? Is the evidence about design, operation, behaviour or outcome? Would the evidence convince someone outside the process?

Cadence
What rhythm does this issue need? Weekly traction, monthly challenge, quarterly ARC visibility or immediate escalation?

Escalation
What would trigger escalation? Repeated slippage, weak ownership, increased exposure, no interim mitigation or no executive decision?

Audit committee relevance
Does the audit committee need to know? If yes, what is the judgement, not just the update? What challenge or decision should the paper support?

If you cannot answer those questions, the issue is probably not under control.

It is only being tracked.

Leadership credibility in internal audit is not built through confidence alone.

It is built through operating discipline.

The rhythm of the function. The quality of the paper. The clarity of ownership. The escalation logic. The follow-through after the meeting. The ability to turn evidence into decisions.

This is where board trust compounds.

Not because the function is louder.

Because the function is easier to rely on.

If this edition was useful, I also share free practical resources for internal audit and assurance leaders, including tools on stakeholder influence and AI defensibility. These are designed to help you move from insight to traction.

I’ll also be using future BtL live sessions and webinars to go deeper into board trust, modern internal audit leadership and Human + AI operating models. Keep an eye on the newsletter for upcoming sessions.

And, if you still haven’t registered for the first session of the Leadership Signals series on Thursday 30th April 5.30pm BST then I’d love for you to join me.

The first of this mini series will focus on Modernising the Three Lines at scale: how to reduce friction and duplication without creating more bureaucracy.

We’ll be getting into questions like:

It’s going to be a great conversation, so please register today and join me as BtL grows into more than a newsletter.

If you know someone trying to make internal audit more influential, practical and commercially relevant, please forward this edition to them.

That is what Beyond the Lines™ is here to help with.

Less control theatre. More decisions, ownership and outcomes.

Best,

Tim Buckley

Founder Beyond the Lines™ | Integral Assurance

AI has everyone talking. Not everyone has answers. At Gladly Connect Live, CX leaders from Condé Nast, Smith Optics, and more share exactly how they moved AI from pilot to production, the timeline, the systems, the QA loops. 13+ sessions built for the moment we're all in. For CX and ecommerce leaders. Atlanta, May 4–6. Space is limited, secure your spot now.

Register now