Beyond the Lines – Issue 40

Good morning {{name}},

I’m Tim Buckley, founder of Beyond the Lines™.

Beyond the Lines™ is an internal-audit-led platform for people working across audit, risk, controls and governance who want to turn insight into better decisions, clearer ownership and stronger outcomes in a Human + AI world.

Less control theatre. More decisions, ownership and outcomes.

If you are new here, welcome.

Each week, I write about the practical reality of internal audit leadership: board trust, audit committee relevance, management ownership, decision-ready reporting, controls that actually change behaviour and how audit leaders can stay credible in a Human + AI world.

Most audit work does not fail at the point of testing. It fails in the handoff.

The handoff from evidence to message.
From message to management decision.
From decision to ownership.
From ownership to follow-through.
From follow-through to actual behaviour change.

That’s where good audit work often loses force.

The report may be technically right.
The finding may be valid.
The committee paper may be accurate.
The action may be accepted.
The AI-assisted draft may read well.

But somewhere between audit identifying the issue and the business changing something, the work loses momentum.

This week is about that gap. Not another generic debate about audit value. A more practical question:

Where does audit work get lost after the work has been done?

That is the problem I’ve been building around with the Board-Trusted CAE Toolkit (more on that later).

Because the next stage of internal audit transformation is not just better methodology. It’s better handoff.

From insight to decision. From decision to ownership. From ownership to movement.

I’ll be joined by Sandro Boeri, Culture & Leadership Advisor to Boards and Executives, for an upcoming Beyond the Lines™ live session on Thursday 18th June at 12.30 BST:

Culture in action: How to audit behaviour without it becoming subjective

Culture is rarely the problem on paper.

The real issue is often the gap between what is said and what actually happens.

That matters for internal audit because behaviour shapes decisions, escalation, accountability, ownership and whether controls actually work when pressure hits.

In this session, we’ll explore how audit teams can engage with culture and behaviour in a way that is practical, credible and grounded in real work.

This is not about turning audit into organisational psychology.

It is about understanding how behaviour shows up in areas like hiring, incentives, escalation and accountability, and how that can be assessed in a structured, evidence-based way.

Internal audit tends to spend a lot of energy making the work technically sound.

That’s necessary.

The testing needs to stand up.
The evidence needs to be defensible.
The judgement needs to be fair.
The recommendation needs to be reasonable.
The report needs to be clear enough to survive challenge.

But once the work leaves the audit file, a different test begins. Does it land?

Does management understand what needs to change?
Does the right person own the outcome?
Does the audit committee know what to discuss or challenge?
Does follow-up test movement, or just completion?
Does the behaviour in the business actually change?

This is the part of audit transformation that gets less attention. We talk a lot about risk assessment, methodology, ratings, audit plans, assurance maps, dashboards and AI-enabled productivity.

All useful. But the value of audit is often won or lost after the technical work is complete.

It is won or lost in the handoff.

The first handoff is from evidence to message. This is where an audit team moves from “what did we find?” to “what does it mean?”. That sounds simple., but it’s not.

A technically accurate finding can still be weak if the message does not make the consequence clear.

Take an access review issue. Audit may find that reviews were not completed on time, evidence was incomplete and leavers were not consistently removed. That is a valid finding.

But the message should go further.

Who owns access discipline?
What decision needs to be made?
What residual exposure remains?
What evidence would prove the control is working again?

A finding that only describes the weakness may be accepted. A finding that makes the decision, owner and consequence clear is much harder to park.

The handoff fails when audit says what happened, but not what it means for the business.

The second handoff is from message to decision. This is where a lot of audit reports quietly lose impact. Management may agree with the finding. But agreement is not the same as a decision.

Sometimes the real decision is about funding.
Sometimes it is about stopping something.
Sometimes it is about changing an operating rhythm.
Sometimes it is about accepting a risk openly.
Sometimes it is about escalating a blocker.
Sometimes it is about making one person clearly accountable.

If the audit output does not make that decision visible, the finding becomes easier to acknowledge than act on. This is why “management agreed” can create false comfort.

The better test is: What decision was made because of this work?

If the answer is unclear, the handoff has not worked.

The third handoff is from decision to ownership. This is where audit needs to be careful with action plans. Most action plans name someone. That does not mean ownership is clear.

There is a difference between the person completing the task and the person accountable for the outcome.

The task owner updates the policy.
The outcome owner makes sure the behaviour changes.

The task owner uploads evidence.
The outcome owner makes sure the control operates.

The task owner closes the tracker.
The outcome owner remains accountable if the risk has not moved.

This distinction matters most when issues cut across teams, systems or leadership layers.

If audit only tracks task ownership, it can miss the bigger question:

Who owns the result?

The fourth handoff is from ownership to follow-through. This is where many audit issues start strong and then fade.

The meeting goes well.
The action is agreed.
The deadline is set.
The owner is named.

Then the business gets busy.

Priorities shift.
Resources move.
Pressure increases.
The blocker remains.
The tracker still shows progress.

Follow-up should not just ask whether the date is still achievable. It should test whether the commitment is still real.

Are blockers being removed?
Has the issue been reprioritised?
Has management changed the rhythm?
Is the owner still active?
Is the business doing anything differently?

Follow-up is where audit either creates pressure for movement or drifts into administrative tracking.

The fifth handoff is from follow-through to behaviour. This is where audit follow-up needs to move beyond asking whether the action has been completed.

The better question is: Are people doing anything differently?

Culture becomes relevant here because culture is not just what people say in surveys, policies or leadership messages. It is what people do when there is pressure.

Do people escalate earlier?
Do they pause when the control says stop?
Do they challenge poor evidence?
Do they prioritise remediation when delivery targets are tight?
Do they own uncomfortable issues or route them around the system?

This is why culture matters to internal audit.

Not as a vague theme. As observable evidence of whether the business is managing risk differently. An action can be closed while behaviour remains unchanged. A control can be redesigned while people still bypass it. A committee can see green status while the underlying operating reality has not moved.

That is the gap audit needs to be capable of seeing. And it is why the upcoming session with Sandro matters.

Auditing culture should not mean making subjective claims about whether a culture is “good” or “bad”. It should mean looking at observable behaviour in real business processes: hiring, incentives, escalation, accountability, decision rights and control operation.

That is where culture becomes auditable.

The sixth handoff is from behaviour to outcome. This is where audit needs to avoid overclaiming. Behaviour change matters, but it is not the final answer.

The final question is whether that changed behaviour has improved the risk position.

This is the difference between activity, behaviour and outcome.

Activity is what was done. Behaviour is what people now do differently. Outcome is what changed because of it.

For internal audit, this matters because audit committees do not only need to know that management has taken action. They need to know whether the risk is now better managed.

That means looking for evidence such as:

This is where board trust is built.

A board-trusted CAE is not just able to say: “The action has closed.”

They are able to say: “The action has closed, behaviour has changed, and we have evidence that the risk position has improved.”

That is a different level of conversation. It is more useful. It is more honest. And it is much more relevant to the board.

There is also a newer handoff audit leaders need to think about. The handoff between human judgement and AI-supported output.

AI can help internal audit work faster.

It can draft.
Summarise.
Structure.
Compare.
Organise.
Improve clarity.

But AI can also make weak judgement look more confident. It can make thin evidence look more coherent. It can hide assumptions inside cleaner language.

So the handoff question becomes:

What remains human?

Evidence quality.
Professional judgement.
Challenge.
Confidentiality.
Final sign-off.
Accountability.

AI can improve the mechanics of audit work. But it cannot own the conclusion.

The risk is not that AI writes badly. The risk is that AI writes well enough to disguise a weak judgement path.

Use this on one real piece of audit work this week. Choose a report, finding, action, committee update, AI-supported draft or escalation note. Then ask:

If one handoff is weak, do not rewrite the whole report. Fix that handoff.

Clarify the decision.
Name the outcome owner.
Strengthen the evidence of movement.
Make the committee ask explicit.
Show the behaviour that needs to change.
Test whether behaviour has changed the risk position.
Make the judgement path defensible.

Small changes in handoff quality can create much better audit conversations.

This is one of the reasons I’ve been building the Board-Trusted CAE Toolkit.

It’s not designed to help audit leaders produce more documents. It’s designed to help CAEs and senior audit leaders take one real piece of audit work and move it through the handoffs that matter:

Evidence to message.
Message to decision.
Decision to ownership.
Ownership to follow-through.
Follow-through to movement.
Human + AI output to defensible judgement.

The Toolkit will give audit leaders a practical way to take work they are already doing and make it more decision-ready, committee-ready and outcome-focused.

The point is not another theoretical model. It’s a working system for making audit work land.

More on the Toolkit soon. If you want beta and early access updates, keep reading the newsletter over the next couple of weeks, I’ll be offering exclusive first access to BtL subscribers before anyone else.

Internal audit value is not created because the work was completed. It is created when the work survives the handoff.

From evidence to message.
From message to decision.
From decision to ownership.
From ownership to behaviour.
From behaviour to outcome.

That is where board trust is built. Not in the existence of the report. In what changes after it lands.

Less control theatre. More decisions, ownership and outcomes.

Best,

Tim Buckley

Founder Beyond the Lines™ | Integral Assurance

Register for Culture in action: How to audit behaviour without it becoming subjective

More on the Board-Trusted CAE Toolkit coming soon. Keep reading for beta and early access updates.

When you started out, doing your own books made sense. But the business you're running today isn't the one you started. If your accounting hasn't kept pace, it's quietly costing you — outdated financials, no clear view of what's actually profitable, and hours every week pulled away from the work that grows your business. At BELAY, our Financial Experts integrate directly into your business. They manage your books, reconcile accounts, run payroll, and deliver the timely insight you need to make big decisions with confidence. Stop guessing. Start knowing.

Download the Free Guide