ASSURANCE TO ACTION FOR INTERNAL AUDIT, RISK & CONTROLS LEADERS
ISSUE 051 • 5 MIN READ
━ ━ ━
Hi {{name}},
Most functions can show what they delivered. The harder task is showing what changed because of it.
Last issue looked at where assurance impact can leak. This one asks a simpler question: how do you know whether the work changed anything?
The answer is to design the evidence before the work starts. This Working Note explains why that matters in a faster, AI-enabled environment, then uses a simple evidence ladder, a planning exercise and a worked example to separate delivery from movement, outcome and value.
IN THE ROOM
INTERNAL AUDIT CONFERENCE 2026
29–30 September | Tottenham Hotspur Stadium, London
I’ll be leading the in-person workshop “Engendering professional scepticism in the audit team” on Wednesday 30 September from 11:45am to 12:45pm.
Professional scepticism is often treated as an individual trait. In practice, it also depends on whether the team creates the conditions for evidence to be tested, assumptions to be challenged and different views to be heard. That is what we’ll work through in the session.
I’m really looking forward to the conference, and delivering my session, and I hope to see a lot of the BTL subscribers there. If you’re attending, please come and say hello to me.
HELP SHAPE BRADLEY’S SESSION
I recently met with my friend Bradley Alexander from Hanami International. Bradley is also preparing for the conference, where his session looks ahead to “Internal Audit in 2030”. He asked whether BTL readers could help ground it in what internal audit leaders and practitioners genuinely expect to change.
His question is:
WHAT DO YOU THINK WILL BE ON JOB DESCRIPTIONS FOR INTERNAL AUDITORS IN 2030?
Share one or two things you expect to see. It could be a skill, responsibility, technology expectation, behaviour or way of working. A word such as AI is useful; a sentence explaining what that requirement would look like in practice is even better.
Your identity will remain confidential. Your message will come directly to me. Before I share any response with Bradley, I’ll remove names, organisations and other identifying details. Anything he uses to shape his conference session will be anonymous. Please do not include confidential or sensitive information.
You can also simply reply to this email.
BTL WORKING NOTE 01
DESIGN THE EVIDENCE BEFORE THE WORK STARTS
Value becomes easier to evidence when the starting position, intended change, owner and measures are agreed before the work begins.
WHY THIS MATTERS NOW
Assurance work is becoming faster and more data-rich. Teams can test larger populations, automate monitoring, generate dashboards and use AI to analyse evidence or communicate findings. That can improve coverage and speed. It can also make delivery look more impressive without making impact any clearer.
As output becomes easier to create, the distinction between “we produced more” and “something improved” becomes more important. An automated control can execute consistently and still fail to influence the decision, behaviour or exposure it exists to change. An AI-assisted review can identify more exceptions and still leave management unclear about what needs to happen next.
For internal audit, risk and controls leaders, this is a credibility and prioritisation issue. Without a baseline, an outcome owner and an agreed sign of movement, you cannot tell which actions worked, where to follow up, what to stop or whether technology investment is producing better outcomes. Designing the evidence early gives you a basis for those decisions.
THE EVIDENCE LADDER
The ladder separates what assurance delivered from what changed and why it mattered.
DELIVERY
Activity and Output show what assurance did and produced.
CHANGE
Movement is the first observable shift in decisions, behaviour, control operation or exposure.
RESULT AND VALUE
Outcome shows what improved. Value explains why that improvement mattered.
The common mistake is treating evidence of delivery as evidence of value.
Reviews completed, reports issued, recommendations agreed and actions closed are useful delivery evidence. They show capacity, execution and follow-through. They do not show that the underlying condition changed.
Movement is the first observable sign of effect. It is where the work leaves the assurance process and starts to affect the organisation. A better-informed decision, earlier escalation, different behaviour, stronger control operation or reduced exposure can all be movement.
Outcome shows whether the intended result occurred. Value explains why it mattered. The evidence becomes harder as you move up the ladder because delivery sits largely within the function’s control, while movement and outcome depend on management action and wider conditions.
That is why ownership and evidence must be agreed up front. Assurance can clarify the problem, influence a decision, challenge the response or strengthen the evidence. Management still owns the organisational result, and a credible contribution statement should reflect that.
PUT IT TO WORK
DESIGN THE EVIDENCE UP FRONT
Choose one significant review, action or improvement initiative. Before delivery begins, agree the following with the person who owns the intended outcome.
STARTING POSITION
What is happening now?
INTENDED CHANGE
What should be different if the work has an effect?
OUTCOME OWNER
Who has the authority and accountability to make that result happen?
EVIDENCE OF CHANGE
What early change should you look for, and what later result would show improvement? When will you review each, and why would that result matter?
ASSURANCE CONTRIBUTION
How will assurance help without claiming ownership of management’s result?
Use this as a planning conversation during scoping or action design. Do not wait until year-end.
Here is what that planning conversation looks like when applied to one control.
ILLUSTRATIVE EXAMPLE
A CONTROL DESIGNED TO ESCALATE SUPPLIER FAILURES EARLIER
STARTING POSITION
Significant supplier failures are identified and escalated inconsistently, delaying corrective decisions.
INTENDED CHANGE
Significant failures are identified sooner and escalated consistently to the right decision-makers.
OUTCOME OWNER
Procurement operations leadership.
EVIDENCE OF CHANGE
Movement — early check: During the first month, significant supplier failures are identified sooner and escalated consistently against the agreed thresholds.
Outcome — later review: After three months, corrective decisions are being made earlier and repeated supplier disruption is reducing.
Value — why it matters: If that improvement is sustained, operational resilience and management confidence should strengthen.
ASSURANCE CONTRIBUTION
Assurance clarified the failure pattern, challenged the control design and agreed the evidence needed to assess whether it worked.
The dashboard and process are outputs. Earlier escalation is movement. Reduced disruption is the outcome. Stronger resilience is the value.
The point is not to predict the future with certainty. It is to agree in advance what evidence would make the later claim credible.
BTL TOOLBOX
THE CONTROL USEFULNESS QUICK CHECK
The evidence-design exercise defines the change you need to see. The Quick Check tests whether the control is capable of creating it.
A control can be documented, approved, automated and consistently executed yet still be weak if it does not change a decision, behaviour or exposure. In an AI-enabled environment, that weakness can become harder to see: automation may scale the design faster and produce more evidence that the activity happened.
This is why the Quick Check follows the Working Note. Use it after agreeing the intended change and movement, but before finalising the control or its reporting. It examines the control’s Purpose, Decision, Behaviour, Operability, Evidence and Adaptability.
In the supplier example above, the evidence plan says that failures should be escalated earlier. The Quick Check then asks whether thresholds are clear, decision rights exist, people will behave differently, the control can operate in practice, evidence will reveal its effect and the design can adapt as the environment changes.
USE THEM TOGETHER
DEFINE THE CHANGE
Agree the current position, intended change, owner and evidence.
TEST THE DESIGN
Check whether the control can realistically create that change.
PLAN THE FOLLOW-UP
Confirm what will be measured, when it will be reviewed and who will respond.
Assess one live control using the complete usefulness field guide below.
Use the worked monthly user-access-review example as a reference.
Identify the first design improvement when a test is weak.
Tim Buckley
Founder, Beyond the Lines™ | Integral Assurance
Assurance Impact | Assurance to Action