Good morning {{name}},

Beyond the Lines™ is approaching its 50th edition, which has come around so fast. It feels like yesterday that I wrote the first edition and wondered, will anybody read this? Although I had some doubts, I thought if I can add value to just a handful of people in my industry, then it’s worth it. And now we have ~5,000 subscribers across Beehiiv and LinkedIn! Thank you so much for sticking with me on this journey.

Now feels like a sensible moment to take stock before deciding what this should become next.

Over the last year, this newsletter has returned again and again to a set of problems that sit across audit, risk and controls: assurance that is accepted but does not lead to action, controls that survive testing but do not change behaviour, governance that creates visibility without decision, AI pilots that generate activity before the work has been properly redesigned, and teams being asked to prove value while operating with less time, less capacity and more complexity.

Those issues are not theoretical. They show up in audit plans, material controls programmes, committee packs, RACMs, action trackers, transformation meetings and executive conversations every week. They are also the reason I don’t want Beyond the Lines™ to become another place where people read something sensible, nod along, and then return to the same unresolved pressures.

The next phase has to be useful in a more demanding sense of the word. Useful to people leading audit, risk and controls work inside real organisations. Useful to teams trying to move from documentation to confidence, from findings to action, from AI interest to practical adoption, and from assurance activity to visible risk movement.

I have my own views on where the value sits, but that’s not enough. It’s very easy to build the thing that is interesting to create rather than the thing people would actually use, recommend, fund or take back to their team.

So this week I’m asking each of you for your input.

I have put together a short subscriber survey. It should take under two minutes, and the answers will directly shape what Beyond the Lines™ focuses on next: the topics I write about, the practical tools I create, the problems I prioritise, and the type of support that may be useful for individuals and teams.

I will also share the broad themes back once I have reviewed the responses, so you can see what other audit, risk and controls professionals are wrestling with too.

Even a few candid answers are more useful than a hundred assumptions. If you have read quietly in the background, shared an edition, challenged an idea, used something in your own work or simply found one paragraph helpful at the right moment, I would genuinely appreciate your input.

Thank you so much in advance 🙏

Continuing with the theme of keeping Beyond the Lines™ focussed and useful, I thought I would share a framework which I use as part of my consultancy work through Integral Assurance. Although some of the language is similar to what we have discussed in previous editions, this is something I use to anchor all of my work, both for me and the clients I work with. So, I think it’s a good time to share this as we consider usefulness in our work, not in an abstract sense.

Usefulness is a harder standard than most professional work admits.

Audit, risk and controls teams can produce a lot of credible activity. The audit file is complete. The report is issued. The control is tested. The risk is logged. The action is tracked. The committee is informed. The dashboard is updated.

From inside the process, that can look like progress. The machinery is moving. The evidence exists. The governance route has been followed.

But, sometimes the hardest question to ask yourself is whether the work changed anything that mattered.

That’s where I think useful work has to pass four tests.

The decision test asks: what decision does this work improve?

This is where technically strong work can lose influence. A review may answer the audit question without getting close enough to the business decision. A report may describe a weakness without clarifying the choice now facing management. A control assessment may confirm the design gap without making the trade-off visible to the person who needs to fund, accept or change it.

The decision might be whether to redesign a control, escalate a risk, approve investment, change ownership, accept residual exposure, challenge a supplier, intervene in a programme, or stop a process that no longer earns its place.

If the decision is unclear, the work is already at risk of becoming activity. It may still be accurate. It may still be defensible. It may even be well received. But it’s harder to use.

The behaviour test asks: what should happen differently afterwards?

This matters especially in controls. A control can look adequate in documentation, pass a sample test, and still be fragile in the real operating rhythm of the business. The process may depend on memory, goodwill, manual workarounds, late intervention, or one experienced person quietly holding the position together.

That’s why “the control operated” can be too thin a conclusion.

Useful work should make the expected change visible. Who does something differently? What happens earlier? Which shortcut stops? Which hand-off becomes clearer? Which exception gets escalated rather than absorbed? What will the business notice when pressure returns?

The point of a control is not to survive testing. It’s to change what happens.

The capacity test asks: what does this require from the people expected to use it?

This is one of the most underplayed questions in transformation. Audit, risk and controls teams are often asked to improve maturity by adding more: more testing, more stakeholder engagement, more analytics, more AI experimentation, more reporting, more documentation, more follow-up and more governance.

Each addition may be reasonable in isolation. Collectively, they can make the system heavier.

When teams are overloaded, they adapt. They complete the visible step. They protect the deadline. They satisfy the tracker. They attend the meeting. What gets squeezed is usually judgement, challenge, reflection and follow-through.

That should worry us. I know it worries me.

Capacity is part of the control environment. A process that only works when people are heroic, calm, experienced and available is not a strong process. It’s a dependency with professional language around it.

Useful work has to ask what should be stopped, simplified or redesigned. If something new is important enough to add, it should be important enough to displace something weaker.

The evidence test asks: how will we know the position has improved?

Action tracking often stops too early. It proves that tasks were completed, without proving that the risk moved.

Training delivered. Policy updated. Owner assigned. Meeting held. Evidence uploaded. Status moved to green.

All of those things may be necessary. None of them automatically proves that the underlying issue has been addressed.

Useful evidence looks for movement in the position. That might mean fewer exceptions, earlier escalation, clearer ownership, reduced manual dependency, better decision quality, fewer repeat issues, improved control performance, or a more explicit acceptance of residual exposure by the right person.

Some evidence will be qualitative. That’s fine. Not every important change can be reduced cleanly to a metric. Sometimes the first sign of progress is better judgement, a sharper question, a different conversation, or someone finally understanding the issue more clearly.

But even those human changes should eventually connect to better decisions, behaviour or outcomes.

The framework is deliberately simple:

Decision: What decision does this improve?

Behaviour: What should happen differently afterwards?

Capacity: What does this require from the people expected to use it?

Evidence: How will we know the position has improved?

It can be applied to an audit report, a controls programme, an AI pilot, a risk dashboard, a governance pack, an action plan, a committee paper or a team development programme.

It can also be applied to Beyond the Lines™.

If the next phase is going to be worth building, it has to solve problems people recognise from their own work. It has to be practical enough to use, specific enough to matter, and valuable enough that teams would make space for it.

That is why I am asking for your input now.

If you have not already completed the survey, I would really value two minutes of your time.

The final question is the one I care about most:

What is the one problem you most wish someone would solve for your team?

That answer will tell me more than any vanity metric ever could.

Thank you for reading, replying, sharing, challenging and quietly following along as Beyond the Lines™ approaches 50 editions.

I appreciate it more than you probably realise.

Best,

Tim Buckley

Founder Beyond the Lines™ | Integral Assurance

Beyond the Lines™ is for people working across audit, risk and controls who want the work to lead to better decisions, clearer ownership and visible improvement.

If this edition would be useful to someone in your team or network, please share it with them.

They can subscribe to the weekly newsletter here.

The best assistants don't multitask their attention across a hundred tools. Neither does Catch. It's an AI agent that focuses on one thing — the admin work you'd rather not touch — and does it exceptionally well.

Scheduling, flights, restaurants, follow-ups, vendors, clients. You hand it over; Catch handles the back-and-forth and comes back with it done.

No context-switching. No dropped balls. Just your admin, quietly cleared — so your focus stays on the work only you can do.

Meet the agent built for admin, and it'll be ready to work before your next meeting.

Get started at catchagent.ai — and give your attention back to what matters.

Start now for free