ASSURANCE TO ACTION FOR INTERNAL AUDIT, RISK & CONTROLS LEADERS

ISSUE 053   •   13 OCTOBER 2026   •   11 MIN READ

━ ━ ━

BEYOND THE LINE

At the IIA conference, discussions about connected geopolitical risks brought me back to the question behind my professional scepticism workshop: how do we know our conclusions still hold when circumstances change?

This issue uses a third-party resilience and continuity planning case to explore that question. The aim is practical: spot when a reassuring conclusion runs ahead of the evidence, then make the uncertainty and next decision clear. Apply the same check to a live audit report, risk assessment or controls update.

An illustrative example, not a client case.

You are reviewing an audit of third-party resilience for a manufacturer reliant on a critical component. Its business continuity plan names a backup supplier to maintain production if the main supply is disrupted. The draft conclusion reads:

A transport disruption occurs before the report is issued:

Would you sign off? What needs checking, and what needs management’s attention now?

I would not sign off. Naming a backup supplier does not establish that the business can maintain supply through this disruption.

Current stock, demand and delivery estimates indicate a potential seven-day supply gap. The shared route matters too: the backup may be exposed to the same disruption.

We need evidence that the fallback can work under these conditions. These facts do not automatically settle the audit rating, but our conclusion must reflect the uncertainty.

A more defensible interim conclusion would be:

Next, verify stock, demand and delivery estimates, and the backup’s capacity, specification and feasible route. Establish how long production could tolerate an interruption and which alternatives management can activate in time. The potential gap needs management’s attention while that work continues.

PUT IT TO WORK

Take the strongest claim in a live audit report, risk assessment or controls update. Complete these three sentences:

Revise the paragraph so its scope and confidence match the evidence. State any material uncertainty and what needs checking. If it stands up, keep it.

The output: a clearer conclusion and a focused next step, within your existing review.

WHAT CHANGES

Management needs to decide how to address the potential gap, by when and who will act: secure an alternative, change the route, adjust production or accept an interruption within its authority.

Internal audit makes the exposure and assurance limits clear, and assesses the response. Management owns the continuity decision.

IN THE ROOM

I enjoyed two days at Tottenham Hotspur Stadium, including delivering my workshop on professional scepticism. Four things stayed with me:

Connected risks: geopolitical events need to be considered through their interdependencies, as the shared route illustrates.

AI: the creativity and range of uses in internal audit were striking, particularly how people are adding value.

The human side: judgement, scepticism and relationships matter more than ever. I expect our roles to change over the next three to five years, and again over ten. Let’s prepare with confidence.

People: reconnecting with past colleagues and meeting new people was a highlight. I felt fortunate to have that time.

GUEST PERSPECTIVE

The BTL case asks whether a continuity plan can support the business when conditions change. Elliot Poublan, founder of Initia Risk, explores a related question: do risk frameworks help the people who use them manage risk in practice?

His article adds a different perspective on this issue’s wider theme: making risk and assurance work useful to the business.

By Elliot Poublan · Initia Risk

“Most risk frameworks do not fail because the methodology is weak. They fail because they were designed for the wrong audience.” I’m sure you’ve heard that before, and while it can sound a bit neat as a soundbite, once you’ve spent enough time inside risk programmes, you’ll start thinking back to this quote and thinking “Ah, I get it now “.

In this piece I’ll unpack why that keeps happening, and later I’ll set out some clear, actionable steps you can take from today to start shifting your framework toward the people who actually use it.

Walk into most regulated firm and you will find a framework that looks solid on paper: risk taxonomies, scoring matrices, control libraries, escalation paths, policy references - everything a second-line team, an auditor or a committee pack needs to evidence that risk is “under control.” Then look at what the first line does with it. Spreadsheets get chased at quarter-end, assessments come back late or not at all, and you end up with owners who cannot explain the residual position on a risk that carries their name, while green registers sit next to rising incidents.

You’ll sometimes see half a risk forum or committee taken up just reminding risk owners of their appetite positions and why those were set that way, which is rarely a good use of anyone’s time and usually a sign that the framework is living more in the pack than in the business.

The gap is not usually competence. It is design. Frameworks get built around how risk and compliance need to oversee, report and assure, rather than around how operational teams need to identify, manage and escalate risk while they are busy running the day job.

Second-line teams sometimes respond to poor adoption by adding more structure: more fields, more guidance notes, longer questionnaires, clearer ownership statements in the policy. This is somewhat understandable and creates the illusion of maturity, but it rarely works in the way people hope.

A framework can be methodologically sound and still be unusable. If updating a risk takes twenty minutes, needs three systems, and uses language the business does not speak, people will do the minimum to get the chase email to stop. That might keep the process moving on paper, but it is not ownership in any meaningful sense.

I have seen this repeatedly. A firm invests months refining its RCSA methodology - careful design versus operating effectiveness criteria, neat residual scoring rules, a polished board heat map - and on paper it looks excellent. In practice, process owners treat the cycle as an annual homework exercise and rate controls as effective because the alternative is a long conversation, alongside actions they do not have time for. Second line then spends weeks reconciling inconsistent scores and chasing evidence, so oversight improves for the pack while day-to-day risk management barely moves. What you end up with is a framework designed to produce something second line can defend, rather than something a first-line manager can sensibly work with in the five minutes they have between operational priorities.

Assigning ownership is the easy part. Making ownership practical is the harder job, and it is the part most frameworks under-design. Putting a name in a column satisfies the governance model, but it does not tell that person what “good” looks like this week, how long the task should take, what evidence is enough, or how their update feeds decisions that matter to them.

If the only feedback they get is another reminder email, it is hardly surprising that the work starts to feel like unpaid admin for somebody else’s reporting cycle. Practical ownership usually means taking friction out of the work itself: keep tasks short and recognisable, use language the business already uses - money, clients, capacity, delivery - be clear about what the owner decides versus what second line challenges, and close the loop so owners can see when their update changed a board view or an action priority. People engage more readily when the work feels like a manageable part of running their area well, rather than a parallel compliance process bolted on afterwards.

A lot of the distance between first and second line starts with language and process design, even when everyone involved is trying to do the right thing. First-line teams hear phrases like “inherent versus residual,” “control design effectiveness,” and “KRIs against appetite thresholds.” Second line hears precision in that, which makes sense if your job is aggregation and challenge. Operations often hears a foreign dialect layered on top of work they already understand in simpler terms: what could go wrong, what stops it, and whether that is still working.

Process design widens the gap further. When the only way to update a risk is through a central template owned by risk, on a calendar owned by risk, using definitions written by risk, the message is clear: this is their system, and you are a data supplier. That does not mean second line should abandon standards - shared taxonomies, locked scoring scales and a tight control library are what make challenge legitimate later. The mistake is designing those standards only for aggregation and assurance, then hoping first-line usability somehow follows.

If you want to move this in the right direction without waiting for a full framework redesign, there are a few practical places to start. None of them require a new system on day one, and most will tell you quickly whether your framework is serving the people who use it or mainly the people who oversee it.

If you want a quick read on where you are, pick three named risk owners and ask whether they can explain their biggest risk, the controls doing the most work, and what would make them escalate this month - without opening the policy pack. If they can, you are probably closer to a framework people use. If they cannot, the framework may be serving oversight well enough to look complete, without yet serving the people expected to run it.

Build for them first, and oversight tends to get better as a consequence, rather than as a substitute.

Elliot Poublan is the founder of Initia Risk. He has spent his career in and around enterprise risk and GRC for regulated firms, building risk frameworks, RCSAs and board-ready reporting that the first line will actually use.

WORKING WITH BTL

Turning a clear finding into a decision and action is the focus of my Assurance to Action System™.

For a free first step with BTL, take the Assurance Impact Scorecard to explore where your assurance gets stuck between insight and outcomes.

To work through a live finding, explore the Assurance to Action Toolkit: practical tools to shape the message, clarify the decision and ownership, and track action.

YOUR VIEW

Work in audit, risk or controls and have a useful lesson to share? Hit reply with a few lines. No finished article needed. I’ll feature contributions when they fit the edition and offer readers practical value.

ONE LAST LINE

Before signing off, ask: what has to remain true for this conclusion to hold?