Beyond the Plan: a 3–5 year strategy for internal audit.
The audit plan says what we do this year. The strategy says where internal audit must be in three to five years: the capabilities to build, the initiatives to run and the enablers to invest in.
You leave with your own strategy house, on one page: your vision, three to five pillars, your first moves, and what you will ask for.
Every internal audit function has a plan. Fewer have a strategy, and since January 2025 the Global Internal Audit Standards expect one: a vision, strategic objectives and supporting initiatives, reviewed periodically with the board and senior management. This 100-minute session builds it as a house: what makes a strategy effective, then the roof, the pillars, the initiatives, the projects and the enablers, each with the tools we use to create it, then how to land it with your audit committee and keep it alive. Six stations to play as we go, and your own house, on one page, to take home. One story runs through it: Maya’s, a fictional chief audit executive whose new committee chair asked where internal audit would be in 2029. It is a Strategy Kick-off Design Session, which Signify runs for internal audit teams: book one for your team , or use everything here on your own.
Three things we will learn together
- 1
What makes an internal audit strategy effective
The six parts of a strategy house, how it differs from the annual plan, and the dos and don’ts that decide whether it lasts.
Part 01 · Stations 1 and 2 - 2
How to build the roof and the pillars
Vision, mission and principles. Then pillars raised from real inputs, with the maturity assessments and the tools we use to find them.
Parts 02–03 · Stations 3 and 4 - 3
How to make it happen
Initiatives on one card and how to monitor them, projects with owners and the people who help, and the enablers that fund it all.
Parts 04–06 · Station 5
And before you leave: how to land it with your committee and keep it alive, then your own strategy house, on one page.
Parts 07–08 · Station 6Why it matters
Internal audit functions fully or almost fully aligned with their organization’s strategy, against those only somewhat aligned: how many percentage points more of them report sufficient funding?
Funding sufficiency was 30 percentage points higher for internal audit functions fully or almost fully aligned with organizational strategy.
Internal Audit Foundation, The 2026 North American Pulse of Internal Audit, March 2026: 373 chief audit executives in the US, Canada and the Caribbean, sponsored by Optro. An association in one survey, not proof that a strategy produces a budget.
What we build together
By 2029, the audit committee relies on us for a continuous view of the risks that matter most, and the business asks for us early.
We give the committee and management independent assurance, advice and foresight on the risks that matter most to the group, so it can take the risks it chooses with confidence.
Risk before rotation · Data first · Early, never owning · No surprises · Short and in time
Data on 60% of engagements by 2029 · a live view from 2028
Top-ten risks 10 of 10 by 2028 · high-risk AI assured within a year
A third of engagements requested by 2029 · every gate of the top three programs
The ask: two data roles, a platform and a co-source panel over 2027–2028, part-funded by stopping three audits.
Maya’s house, the worked example for 2027–2029: a group internal audit team of fourteen, in a business moving finance onto one ERP and putting generative AI to work. Every box on it is a part of the session: open the roof, a pillar or the foundation to see where it is built.
How Maya built it
- MarchThe question
Her new committee chair asks one question: where will internal audit be in 2029? Maya has a good plan, and no answer.
P.04 - April and MayTheir words, and an honest score
Twelve interviews, the chair first, and four assessments. Her largest gaps: continuous insight, audit with data and AI, and assurance over AI.
Parts 02–03 - JuneEleven ideas, three first moves
The SAR picks three: the living backlog, assurance over AI, and continuous auditing of procure-to-pay’s key controls.
Part 04 - Through the summerThe hours, and the foundation
Each first move on a card, then projects with an owner, hours and a gate: one hour in eight of the 2027 plan. Her weakest enabler is technology and data, so her ask has a platform in 2027.
Parts 04–06 - SeptemberTen minutes, one decision
Three weeks out she pre-wires the chair, the CEO and the CFO. In the meeting: ten minutes, one page, and the endorsement minuted.
P.48 · PDF page 48
Maya and her group are fictional: the worked example the session uses. Her moments are common ones, and her figures are illustrative.
How the session runs
- 0:00–0:08Why it mattersThree things we will learn, one number, and the finished house we build together. Poll 1.Slides P.01–P.06Their detail · PDF pages 1–6
- 0:08–0:18Part 01 · What makes it workThe plan and the strategy, the six parts of an effective strategy, and the dos and don’ts. Stations 1 and 2.Slides P.07–P.12Their detail · PDF pages 7–12
- 0:18–0:29Part 02 · The roofStart from their words, then the vision, the mission and the principles, and how to write each. Station 3.Slides P.13–P.18Their detail · PDF pages 13–18
- 0:29–0:47Part 03 · The pillarsThe inputs and how we collect them, four maturity assessments, and three tools that turn them into pillars with objectives and measures. Station 4 and poll 2.Slides P.19–P.27Their detail · PDF pages 19–27
- 0:47–1:03Part 04 · InitiativesChoose with the SAR, write each on one card, two worked in full, what to monitor and how, then one timeline. Station 5.Your turn · P.33a first move’s ninety-day milestone, in the chatSlides P.28–P.35Their detail · PDF pages 28–35
- 1:03–1:10Part 05 · ProjectsSplit each initiative into projects with an owner, hours and a gate, and name who helps.Slides P.36–P.39Their detail · PDF pages 36–39
- 1:10–1:19Part 06 · EnablersRead the foundation off the projects, assess each enabler, and price the ask with what pays for it. Poll 3.Poll 3 · P.42your weakest enabler, which station 6 then shows youSlides P.40–P.44Their detail · PDF pages 40–44
- 1:19–1:27Part 07 · Make it landThe committee’s five questions and the path with no surprises, the same strategy on two slides, and how to keep it alive. Polls 4 and 5.Slides P.45–P.50Their detail · PDF pages 45–50Two slides · PDF page 48
- 1:27–1:40Part 08 · Take it homeYour strategy house on one page, ninety days of next steps, and your questions. Station 6.Slides P.51–P.54Their detail · PDF pages 51–54
Before the session
- 1Your charter and this year’s audit plan. Part 01 sorts plan from strategy: have yours beside you to try it on.
- 2Your last committee minutes. What did the committee ask about the years ahead?
- 3A phone or a second screen to play along, or the PDF on paper. Nothing to install, no sign-up.
- 4Ten minutes afterwards to finish your house in station 6, while it is fresh.
If you were invited, the date and the link to join come with your invitation; if not, book one for your team . The session runs 100 minutes: 90 for the talk and 10 for your questions.
Two ways to follow along
Play along
The six stations below are live. Answer as the session reaches each one. Station 6 turns your answers into your strategy house, on one page, to save as a PDF.
Follow the PDF
Every slide with its full detail, which the screen keeps short, each station as a worksheet, and the answer keys at the back. The page numbers match the slide numbers.
The six tools, in the order we use them
Each station is played at the point in the talk where we build that part of the house, and the last one gathers your answers into your own house. On the slides it is your turn; here you can play at your own pace.
0 of 6 stations played so far. Your house fills in as you go.
Plan or strategy? Sort eight statements.
Part 01 starts with the difference between the plan and the strategy. If a sentence names an engagement, hours or a date this year, it belongs in the plan. If it names a capability or a destination, it belongs in the strategy. Tap one side for each, and every answer tells you why.
This station runs in your browser and needs JavaScript. The PDF has it as a worksheet.
Do or don’t? Six calls from real life.
The dos and don’ts of an effective strategy, met in practice: six moments that decide whether a strategy lasts. They are composites drawn from patterns in practice, with details changed. Make the call, then see what happened.
This station runs in your browser and needs JavaScript. The PDF has it as a worksheet.
Strong or weak? Test eight lines for your house.
The roof, tested: two visions, two missions, two principles and two pillars. Tap strong or weak for each, and every answer gives the test behind it: a strong line could be wrong for someone else.
This station runs in your browser and needs JavaScript. The PDF has it as a worksheet.
Capability gap radar: today, and in three to five years.
The first of the four maturity assessments, on your own function: rate it on the eight capabilities of the improve™ 2.0 lens, from 1 (ad hoc) to 5 (leading), once for today and once for where you must be. The radar draws itself, and your three largest gaps are what your pillars must close.
This station runs in your browser and needs JavaScript. The PDF has it as a worksheet.
Your IA SAR: plot your initiatives, find your first moves.
Choosing initiatives: pick up to six from the four lenses of the Strategic Alignment Roadmap, or add your own, and set each one’s value and how soon it pays off. High value within twelve months lands in the priority zone: those are your first moves, and each one gets an initiative card.
This station runs in your browser and needs JavaScript. The PDF has it as a worksheet.
My strategy house, on one page.
Your capability gaps and first moves come in from stations 4 and 5, and your weakest enabler from poll 3. Add your vision, mission and principles, name your pillars with an objective each, and place every first move in a pillar and a year. Then the foundation and the ask, the measures and a milestone a year. Save it as a PDF, or copy it as text.
This station runs in your browser and needs JavaScript. The PDF has it as a worksheet.
Keep your own answers.
During the session the polls run in the webinar, where the room’s results appear. Tap here as well to keep a note of your own.
Where is your internal audit strategy today?
Which lens holds your biggest gap?
Which enabler is your weakest today?
How does your audit committee engage with your strategy?
When did you last refresh your strategy?
“The chief audit executive must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organization and aligns with the expectations of the board, senior management, and other key stakeholders.” The strategy must include a vision, strategic objectives and supporting initiatives, and the chief audit executive must review it with the board and senior management periodically.
After the session: do this first
The one action the session ends on: book thirty minutes with your committee chair this week. Everything here is yours to copy, print or adapt.
The email to your committee chair
The five questions, to eight to twelve people
- What will the organization look like in three years?
- Where do you need assurance or insight you do not get today?
- What should internal audit stop doing?
- Which risk keeps you up that nobody is looking at?
- What would make internal audit indispensable to you?
The same five every time. Write their words down as they say them: the chair should recognize them in your vision.
Six steps to a strategy the committee endorses
- Ask eight to twelve people the five questions, the committee chair first.
- Rate the eight capabilities with your team: station 4, as a team exercise.
- Raise the roof and set three to five pillars. Station 6 is your first draft.
- Write three initiative cards and split them into projects with owners, hours and gates.
- Read the foundation off the projects, assess it and price it, with what you will stop.
- Pre-wire the chair three weeks out, then present for endorsement.
A blank house to fill in together
One landscape page: the roof, three pillars, the foundation and the ask, the measures and a milestone a year. Print it for a workshop with your leadership team.
Your team, with Signify
We run this Strategy Kick-off Design Session for internal audit teams: your team plays the six stations together and leaves with its own strategy house, on one page.
signifysolution.com/contact · [email protected]