Good morning {{name}},

I’m Tim Buckley, and this is the weekly Beyond the Lines™ newsletter.

Beyond the Lines™ is an internal-audit-led platform for people working across audit, risk, controls, governance and culture who want to turn insight into better decisions, clearer ownership and stronger outcomes in a Human + AI world.

Less control theatre. More decisions, ownership and outcomes.

Internal audit often talks about getting more attention from the business.

More attention from management. More attention from the audit committee. More attention for findings, actions, themes, controls, culture, risk and assurance priorities.

I understand why. Important issues can get ignored. Recommendations can be accepted but not acted on. Audit committee papers can be read quickly between other board commitments. Risk owners can say the right things in meetings and still move slowly afterwards.

But I think there is another side to this that internal audit needs to take seriously.

Management attention is already under pressure.

Most leaders are dealing with growth targets, cost pressure, transformation programmes, operational issues, technology change, people challenges, regulatory expectations and a constant stream of meetings, updates and decisions. They are not sitting around waiting for more audit work to land on their desk.

That does not mean audit should become quieter or less challenging. It means audit has to be more disciplined about the attention it asks for.

Every report, meeting, control, evidence request, action tracker and assurance review uses some of it. Used well, internal audit helps leaders focus on the risks and decisions that matter. Used badly, audit becomes one more source of noise in a business already struggling to focus.

That is the theme of this week’s issue.

AI, future-ready audit skills, control design and the Three Lines all point to the same question: is internal audit helping management focus, decide and act, or is it unintentionally adding to the load?

Before we get into it … a reminder that the next Beyond the Lines™ live session is open for registration.

I’ll be joined by Rania Bejjani, CEO & Founder of RB Advisory & Consultancy | Governance, Internal Audit & Risk Management, and host of the Impact Legacy with Rania podcast to discuss:

Influence without authority: how audit and risk actually get decisions made

This topic sits directly underneath this week’s issue. Audit and risk rarely struggle because they have no insight. More often, they struggle because insight does not reliably turn into action. The message gets softened. The issue gets delayed. The recommendation gets accepted but not truly owned. The governance forum receives the update, but the decision still does not happen.

We will be talking about what influence looks like in practice, how credibility is built before the difficult conversation, and why audit and risk professionals need more than formal authority if they want their work to land.

There is a quiet assumption in a lot of audit, risk and controls work that the business should simply pay more attention.

Pay more attention to audit findings. Pay more attention to controls. Pay more attention to risk registers. Pay more attention to governance forums. Pay more attention to action deadlines. Pay more attention to assurance requests.

Sometimes that is fair. Management does own risk, and ownership should not disappear when things get difficult.

But in practice, internal audit is operating in a crowded attention environment. Senior leaders are not just choosing between “act on audit” and “ignore audit”. They are choosing between competing priorities, limited time, operational pressure, commercial trade-offs and a constant flow of information.

That means audit value is partly determined by how well we use the attention we ask for.

If we ask for attention on issues that are too vague, too late, too technical, too detached from business consequence or too heavy to act on, we should not be surprised when the work struggles to land.

This is not about making audit soft. It is about making audit sharper.

The best audit work does not just add another message to management’s inbox. It helps management understand what deserves attention, why it matters, what decision is required and what needs to change.

That is the difference between adding work and creating focus.

AI will make parts of internal audit faster. It can help draft reports, summarise evidence, structure findings, identify themes, create first-pass commentary and support planning or communication.

Used well, that should be helpful. It should reduce some of the mechanical drag that has made audit work slower and more admin-heavy than it needs to be.

But there is a risk.

AI can also help internal audit produce more content, more quickly, without improving the judgement behind it. More words, more summaries, more polished findings and more efficient documentation do not automatically create better attention from management.

In some cases, AI could make the attention problem worse.

If audit teams use AI to produce more reporting without sharpening the message, management gets more to read but not necessarily more to act on. If AI-generated outputs are not challenged properly, weak thinking can be packaged in cleaner language. If summaries become smoother but not more decisive, the work may look better while still failing to land.

The useful question for audit leaders is not just, “Can AI help us produce this faster?” It is, “Will this output help management focus on the right thing?”

Did we remove noise? Did we sharpen the consequence? Did we make the decision clearer? Did we challenge the first draft? Did we connect the finding to the business issue management actually cares about?

AI can draft and organise.

Humans still need to decide what deserves attention.

Technical audit skill still matters. Internal auditors need to understand evidence, controls, root cause, governance, assurance quality and reporting discipline. None of that goes away.

But technical skill is increasingly becoming the entry fee rather than the differentiator.

The future-ready internal auditor will not just be the person who can complete the work programme. They will be the person who can help busy leaders understand what matters, why it matters and what needs to happen next.

That is a different capability.

It requires judgement, communication, stakeholder influence, commercial understanding, AI fluency and leadership behaviour. It requires the ability to translate audit insight into management attention without making everything feel like an audit priority.

Not every issue is equally urgent. Not every weakness deserves the same level of escalation. Not every control failure needs a board-level conversation. The skill is knowing which signal matters, how to frame it and who needs to act.

This is where internal audit can become far more valuable.

A useful auditor does not just report problems. They help management prioritise. They separate what is material from what is merely messy. They know how to challenge without turning every conversation into conflict. They understand that a finding only creates value when someone has enough clarity and motivation to act on it.

That influence work starts before the report is issued.

By the time the final paper lands, the business should already understand the concern, the consequence and the ownership expectation. The report should not be doing all the work by itself.

Controls are often discussed in terms of effectiveness, evidence and design. That is right, but there is another question worth asking.

A control can be completed on time, evidenced properly and reviewed consistently, while still adding very little value. It may be performed too late to affect the decision. It may be signed off without real challenge. It may create evidence for audit but no useful signal for management.

That matters because low-value controls do not just waste time. They consume attention.

They ask people to review, evidence, approve, reconcile, certify, chase or explain something. If the control helps prevent a real issue, detect a problem early or force a better decision, that attention is justified. If it does not, the control becomes part of the noise.

This is where audit and controls teams need to be more honest.

The question is not only, “Does this control exist?” It is, “Does this control help someone act differently when it matters?”

Does it prevent something important? Does it detect something early enough to intervene? Does it prompt a better decision? Does it trigger escalation when pressure increases? Does it reinforce ownership in the normal flow of work?

If not, it may be admin dressed up as assurance.

A simple test is this:

If this control disappeared tomorrow, what would actually get worse?

If the answer is unclear, the control may be consuming attention without creating enough value in return.

In my recent Beyond the Lines™ webinar with Kristian Bollerup, we discussed modernising the Three Lines at scale. One of the strongest themes was compliance overload.

That phrase matters because it captures what many management teams actually feel.

The problem is not always that assurance activity is missing. It is that assurance activity is fragmented, duplicated or difficult to navigate. Different functions ask similar questions. Evidence is requested in different formats. Governance forums overlap. Risk owners spend time servicing assurance activity rather than improving the underlying risk.

Each individual request may be defensible. Collectively, they can drain attention.

That is where the Three Lines can lose credibility. Not because the model is wrong, but because the operating experience becomes heavy.

A modern Three Lines model should help the business focus attention in the right place. It should clarify who owns the risk, who advises, who challenges, who assures, who decides and who follows through.

When it works well, the business feels clearer. Management understands ownership. Risk and compliance provide support without taking over. Internal audit provides independent assurance without duplicating everyone else’s work. The board gets a sharper view of what matters.

When it works badly, the business feels pulled into multiple assurance processes that do not join up.

Modernising the Three Lines is therefore not just a structure exercise. It is an attention design exercise.

The test is whether the model helps the business see and act on what matters faster, not whether every assurance function can prove it was active.

If management attention is one of the scarcest resources in the organisation, audit leaders need to treat it with care.

Here is a practical test you can apply to an audit report, control, governance forum, action tracker, AI output or assurance request.

First, ask whether the work deserves management attention. This is not about whether the issue exists. It is about whether the issue has been framed in a way that makes the decision, consequence or ownership clear enough to justify attention from busy leaders.

Second, ask whether the work makes the next decision easier. A useful audit output should reduce ambiguity, not simply describe it. If management finishes reading the paper and still does not know what decision is required, the work has not used their attention well.

Third, ask whether the work removes noise or adds to it. Good assurance should make the picture clearer. If the work creates more overlapping requests, more unclear ownership or more repeated discussion, it may be increasing friction.

Fourth, ask whether the right person is being asked to pay attention. Some issues need senior management or audit committee focus. Others need process-level ownership. Escalating everything can be just as damaging as escalating nothing.

Fifth, ask whether the attention leads to action. If the work creates discussion but no change in ownership, decision-making, control behaviour or follow-through, the attention may have been spent without enough return.

Finally, ask what would happen if this work did not exist. If nothing meaningful would get worse, the work may be consuming attention that should be spent elsewhere.

This is not about reducing audit’s ambition. It is about making audit’s ambition more focused.

If this week’s issue resonates, the Internal Audit Value Leakage Map is a useful companion resource.

It helps audit leaders identify where good work loses impact between insight and outcome. That may be because the finding is not connected to a decision, management ownership is unclear, the recommendation is not practical, the audit committee paper does not make the consequence clear, or action tracking focuses more on closure than behavioural change.

In the context of this week’s theme, the map helps answer a simple question:

Where are we asking for attention without creating enough movement?

You can access the free Internal Audit Value Leakage Map here:

Use it before an audit plan review, reporting refresh, audit committee cycle or team discussion on how internal audit can increase its influence.

Pick one audit report, one control and one management action from the last quarter.

For the audit report, ask what management attention it was trying to earn. If the answer is simply “the finding”, go deeper. What decision, consequence or ownership issue needed attention?

For the control, ask whether it creates a useful signal for management or mainly creates evidence for assurance. If the control consumes time but does not change behaviour, it may need to be redesigned, simplified or retired.

For the management action, ask whether attention has turned into movement. Has ownership changed? Has behaviour changed? Has the risk position changed? Or has the action simply moved through the tracker?

You do not need to redesign the whole audit function in one week.

Start by finding one place where audit is asking for attention and make sure that attention is being used well.

Internal audit does not just compete for budget, resources or committee time.

That attention is limited, pressured and already fragmented. The best audit functions will not be the ones that shout louder. They will be the ones that help leaders focus on what matters, understand what needs to change and act with better judgement.

That is where board trust is built. That is where internal audit becomes more commercially relevant. And that is where the future of audit leadership is heading.

Beyond the Lines™ exists to help current and aspiring CAEs lead Internal Audit Transformation in a Human + AI world, turning insight into decisions, ownership and outcomes.

Less control theatre. More decisions, ownership and outcomes.

Best,

Tim Buckley

Founder Beyond the Lines™ | Integral Assurance

Access the free Internal Audit Value Leakage Map
Diagnose where audit value leaks between insight and action.

Register for the next Beyond the Lines™ Leadership Signals session
Influence without authority: how audit and risk actually get decisions made.

Share Beyond the Lines with a colleague
If this helped you think differently about internal audit leadership, forward it to one audit, risk or controls colleague who would value it.

When you started out, doing your own books made sense. But the business you're running today isn't the one you started. If your accounting hasn't kept pace, it's quietly costing you — outdated financials, no clear view of what's actually profitable, and hours every week pulled away from the work that grows your business. At BELAY, our Financial Experts integrate directly into your business. They manage your books, reconcile accounts, run payroll, and deliver the timely insight you need to make big decisions with confidence. Stop guessing. Start knowing.

Download the Free Guide