Beyond
the Plan.

1:00 · ninety seconds

“Three things today.” Read the three titles slowly, then the one line under each. One: what makes a strategy effective, its six parts and the dos and don’ts. Two: how to build the roof and the pillars, including the maturity assessments and the tools we use to find the pillars. Three: how to make it happen, through initiatives, projects and enablers.

Point at the bottom line of each card: the parts it covers and its stations, the tools you use on your phone while I use them on screen. Then the band: we finish with the committee, keeping it alive, and your own house on one page from station 6.

Then the line at the bottom: one story runs through the whole session. You will meet Maya in three minutes.

No break is timed in. If you need one, the natural place is after part 06, at about seventy-nine minutes, and the minutes come out of the questions at the end.

2:30 · ninety seconds

Ask before you show it: “Fully or almost fully aligned with the strategy, against only somewhat aligned: how many percentage points more of them report sufficient funding? Guess in the chat.” Give it twenty seconds; read two or three guesses aloud.

Then reveal it, with the button on the slide or Show example in the console. Thirty points: in the Internal Audit Foundation’s 2026 North American Pulse, published in March, fifty-nine percent of the fully or almost fully aligned said their funding was sufficient, against twenty-nine percent of the somewhat aligned.

Be precise: it is an association in one survey, not proof that a strategy produces a budget. But it is the argument your committee understands, in a year when budget cuts rose from eleven to nineteen percent of functions.

Then show them what a strategy looks like when it is finished: Maya’s house.

4:00 · two minutes

Start with the end, and with Maya. She is the chief audit executive of a group, with a team of fourteen. She is fictional; the moments in her story are common ones. In March her new committee chair asked her one question: “Where will internal audit be in 2029?” She had a good plan. She did not have an answer.

In September she brought back this: her strategy house for 2027 to 2029. Do not explain it yet. Just walk it once, top to bottom.

The roof: where we are going, why we exist, how we decide. Three pillars, each with its objectives and the initiatives inside it. The rhythm across three years. And the foundation: the enablers, and the ask that pays for them.

“Every box on this page is a part of today. By the end you will know how Maya made each one, and you will have the start of your own.” Then hand over to poll 1: where does your own strategy stand today?

7:00 · one minute

Two ways to follow. On the site, the stations are live: you’ll tap answers and see your own results, including a radar of your capability gaps and your own SAR priority map. Each one comes at the point in the talk where we build that part of the house: two in part one, one for the roof, one for the pillars, one for the initiatives, and the house itself at the end.

Or follow the PDF: same slide numbers, every slide with its full detail, and the stations become worksheets. On screen I show the short version.

Reassure on privacy: nothing they type or choose is sent anywhere. Answers live in their browser. At the end, station 6 turns their answers into a strategy house on one page that they can save as a PDF.

8:30 · ninety seconds

The core distinction. The plan answers “what will we audit with the hours we have?” The strategy answers “what must we be able to do in three to five years that we cannot do today?”

Note the units: the plan is engagements and hours; the strategy is capabilities, initiatives and enablers. Different units, different measures.

The plan still matters: it should flow from the strategy, and every engagement can be tagged to a strategic objective. Hand over to station 1 with the test on the band.

11:30 · two minutes

The components of an effective strategy. Six parts, one house. The roof is where we are going and how we behave: vision, mission, principles. The pillars are what stakeholders will notice, and each carries its objectives and measures. Inside the pillars sit the initiatives, on one timeline, split into projects with hours in the plan. Everything stands on the foundation: the enablers, and the ask that pays for them.

Point at the tags. Standard 9.2, in effect since January 2025, requires a strategy with a vision, strategic objectives and supporting initiatives, reviewed periodically with the board and senior management. The house makes those three fundable and real, and Principle 10, on managing resources, is its foundation.

The right-hand list is today’s route: we build top-down, part by part. The check is bottom-up: pick any project and you should be able to walk up to a pillar and to a phrase in the vision. If you cannot, it is a project looking for a strategy. Then the dos and don’ts.

13:30 · ninety seconds

The dos and don’ts that decide whether a strategy lasts. Each pair is a choice you will meet today: one page against forty pages, three to five moves against seventeen, refresh on triggers against file it and forget it. Don’t read all twelve: pick the pair that fits this audience best, usually “one page” against “forty pages”.

We will meet them again as we build: the seventeen initiatives in part four, the one page and the triggers in part seven. Then test your instincts: station 2 turns six of them into calls from real life.

18:30 · two minutes

The roof is written from the outside in, so it starts with other people’s words. This is Maya’s house from minute four. She asked twelve people the same five questions, starting with her committee chair; the questions are in part three, with the other inputs. Here are three of the answers.

Read the quotes, and point at the underlined words: “the risks that matter”, “not once a year”, “before”, “which ones matter”. Listen for nouns and verbs you can reuse word for word. The chair should later recognize their own words in your vision.

Then the paragraph, in your PDF: what is changing in the business, what is changing in the risks, and what that demands of assurance. Under eighty words. It becomes the first page of your appendix and the first minute of your committee presentation.

Your story, if you have one · forty-five seconds. An interview that changed your strategy: a stakeholder’s words you would not have guessed, and what you wrote differently because of them.

20:30 · two and a half minutes

Read the weak vision and ask: “Whose function is this?” Anyone’s. World-class compared with what? Value-adding by how much? Nothing in it can be checked.

Then the strong one, in three parts. A year. People outside the function who will notice: the committee and the business. And what they will experience: a continuous view of the risks that matter most, and being asked early. Those phrases are not decoration: in part three each one becomes a pillar.

Where it came from: the quotes on P.14. The chair said “the risks that matter, as they move”; the vision says “a continuous view of the risks that matter most”. When the chair reads it, they hear themselves. Run the four tests before you show it to anyone, and test it on the chair first.

23:00 · two minutes

Three statements people mix up. The profession’s purpose, in Domain I of the Standards, is the same for every function and changes only when the Standards do. The vision is where this strategy takes us, by a date. The mission sits between them: why your function exists, for whom, and how. It is your mandate and charter in your own words, so it changes rarely.

Read Maya’s mission and point at its parts: whom we serve, the committee and management; what we give, assurance, advice and foresight; on what, the risks that matter most to the group; and so that the group can take the risks it chooses with confidence.

Many functions adopt the purpose statement word for word. That is a fine starting point, and you never contradict it. But a mission that could sit in any charter unchanged says nothing about you. Put your organization in it.

25:00 · two minutes

Principles are the most skipped part of the roof and the most useful day to day. A good principle is a decision made once, in advance: it settles an argument your team has every month, so you do not have to be in the room for it.

Walk two of the five. “Risk before rotation”: when the cycle says an area is due and the risk ranking says it is not, risk wins, and you can defend that to the committee because you wrote it down beforehand. “Early, never owning”: it lets the team say yes to the ERP program’s design workshops and no to signing off its controls.

The test that sorts principles from values: could a good function choose the opposite? Some functions do choose completeness over speed, or rotation over risk. If nobody would ever argue for the opposite, as with “we act with integrity”, it is a value, and the Standards already require it.

Then station 3: eight lines from real strategies, strong or weak.

29:30 · three minutes

Pillars are only as good as what goes into them, so start with the inputs and how to collect them. Four of them. The organization’s strategy and the risk outlook you read first, then test with the CEO, the CFO and the CRO. For the risk outlook, use the external view too: in the IIA’s Risk in Focus 2026/2027, eighty percent of chief audit executives put cybersecurity in their top five risks, and fifty-eight percent digital disruption, including AI.

Stakeholder expectations you ask for. The five questions are the most practical thing on this slide: the same five, to eight to twelve people, the committee chair first, thirty to forty-five minutes each, and write down their words exactly, because the vision is drafted from them; you saw that on P.14. Add a ten-minute anonymous survey for the wider management team. Question 3, “what should we stop doing?”, funds part of your strategy.

Our own starting point you check: the charter, the quality program and the last external assessment, a skills inventory, the hours and the budget, and the maturity assessments on the next slide. Plan about four weeks for all of it.

32:30 · three minutes

The fourth input, our own starting point, needs a measuring stick. We use four, and each does a different job. One: capability maturity, through the improve™ 2.0 lens: eight capabilities, rated one to five, today and in three to five years. It is forward-looking, so it tells you where the pillars must take you. You will use it yourself in station 4, in three minutes.

Two: the IIA’s Internal Audit Capability Model, IA-CM, published by the IIA’s Research Foundation in 2009. Five levels from initial to optimizing, across six elements. It is a good second opinion on how embedded the function is, and widely used in the public sector. Three: conformance with the Standards, from the internal assessment under 12.1 and the external assessment every five years under 8.4. Gaps there are not strategic choices; they are the floor, and they go in the foundation.

Four: what stakeholders think, from a short survey. It becomes the baseline for your lagging measures, such as committee confidence. Then the discipline: the leadership team scores first, then the whole team, with evidence for every score. Where the scores disagree, that conversation is a finding in itself.

35:30 · ninety seconds

The first of the four assessments, up close: the improve™ 2.0 lens. Eight capabilities, each read as a shift from where many functions are to where a high-impact function is heading.

Don’t read all eight. Pick two that land with this audience, usually risk-led planning (the annual plan becomes a living backlog) and assurance over AI.

The scale is one to five, ad hoc to leading. Move to station 4.

41:00 · two minutes

Now the step most teams skip: turning the inputs into pillars. Three tools. One, a theme map: put every input on one wall, the interview words, the gaps from the radar you just drew, the risk outlook, the conformance gaps, and cluster them into three to five themes. Do it with the team, with sticky notes or a whiteboard.

Two, the vision test: every theme must hold up a phrase of the vision. Three, pillar or foundation: would the committee or the business notice it directly? If not, and every pillar needs it, it is foundation.

Then Maya’s three, at the foot of the slide. The chair’s words and the gaps on insight and data became pillar 1. The rising risks and the gap on assurance over AI became pillar 2. The CFO’s “before we sign off” became pillar 3. Data skills and a platform failed the test for a pillar: they are foundation, and we will meet them again in part six.

43:00 · two minutes

The vision test from the last slide, done on our own house: underline the phrases of the vision. Ours has three: a continuous view, of the risks that matter most, and the business asks for us early. Each needs something to hold it up, and the themes from the inputs supply it. That is a pillar: a strategic theme that stakeholders will notice when it works.

The rules, at the foot: three to five pillars; one owner each, on your leadership team; one or two objectives each, with a number and a year; and no overlaps, so every initiative lives in exactly one pillar.

The most common mistake is a pillar called “Technology” or “People”. Ask whether the committee would notice it directly. Nobody on the committee notices your analytics platform; they notice the continuous view it gives them. So technology is foundation, and continuous insight is the pillar. Talent can be a pillar, but only when the organization itself will notice it, for example when internal audit becomes a leadership pipeline for the business.

45:00 · two minutes

Standard 9.2 calls these strategic objectives. In the house they belong to pillars, one or two each, and every one has a number and a year. Without both, the committee cannot track it, and will stop asking.

Give each pillar an owner on your leadership team, and pair each objective with two kinds of measure. A leading measure tells you early whether you are on track, such as data-access agreements signed. A lagging measure tells you whether the outcome arrived, such as the committee actually using the live view at every meeting.

Standard 12.2 asks for a way to measure the function’s performance against its objectives. This is it: six objectives on screen, and in the PDF four more measures for the foundation and delivery underneath. The targets are examples. And the kicker: “audits completed” measures the plan, not the strategy.

47:30 · ninety seconds

The SAR is our quadrant tool. Four lenses (process, technology, people, risk) around the vision. Rank each initiative by value and timeline: the closer to the center, the higher the priority. Gold dots in the dashed zone are high-value, short-term moves.

The cards are a starter library of twelve internal audit initiatives, three per lens. You will pick from these in station 5, or add your own. Every one you keep must name its pillar.

Land the kicker: three to five priority moves a year. Seventeen initiatives means none finish. Maya had eleven good ideas; the SAR told her which three to start.

52:00 · two minutes

You just picked your first moves in station 5. Each one now needs a card: the same eight boxes, half a page, drafted by the owner and tested in the leadership team. The committee sees the house; the card is the appendix behind every initiative on it.

Walk the boxes fast, because the next two slides fill them in. The ones people skip are box 3, written as something someone outside will notice, by a year; box 6, one leading and one lagging measure, which is how you will monitor it, and a first milestone inside ninety days; and box 8, what stops, which is how you pay for it.

The test before a card goes on the timeline: a pillar and an objective, one owner, the two measures, a milestone in ninety days, and what stops. Then how a card gets made, at the foot: the owner drafts it, the leadership team tests it against those five checks and against the other cards, and the sponsor signs it before it goes on the timeline. Station 6 starts the card for you: for each first move, it asks which pillar it sits in and the year it starts.

54:00 · two minutes

Two of Maya’s initiatives, worked in full. On screen, each box in a line; the full card is in the PDF. The first sits in pillar 1, continuous insight. Walk the card in order: the pillar and the objectives it moves; the problem today, in a sentence a CFO would recognize; the outcome, by a date; what we build; who owns it; how we will know; what it needs from the foundation; the risks; and what stops. The sponsor is the chief audit executive, not the CFO: this is assurance over the CFO’s own process, so the CFO is a partner for the data.

Box 6 also names the first milestone, inside ninety days: by June 2027, access approved and the first extract loaded.

Spend a moment on box 8. Continuous auditing is ours; continuous monitoring belongs to management. When one of our rules becomes something the business relies on to run procure-to-pay, it has become a control. So management owns the exceptions from the pilot on, and takes over the rules when we scale; we assure them, or we end up auditing our own work.

And the last line: what stops. The two-yearly sample audit goes once the pilot passes its gate, and not before: stop assurance before its replacement works and you have left a gap. That is about five hundred hours a year back into the plan, and how you pay for part of the strategy.

56:00 · three minutes · start the countdown for your turn

The second initiative sits in pillar 2, assurance where it matters, and it is the one most committees are asking about right now.

Draw out two things. First, the inventory belongs to management: here the chief risk officer’s team owns it, and our first job is to test that it is complete. Second, the method: map it to a framework your organization already uses, such as the NIST AI Risk Management Framework or ISO/IEC 42001, so your findings speak the business’s language. And box 6 names the first milestone, inside ninety days: the twelve known pilots tiered for audit by March.

Then box 8. The fastest way to lose objectivity on AI is to become the approver. Management owns the gate; we assure that it works. And what stops: the AI part of the end-user computing review moves into the governance audit.

Then their turn, one minute. Start the countdown. “Take one first move from station 5. Write its ninety-day milestone: what will be true, and by when, three months from the start. Type it in the chat.” Read two or three aloud and test each against box 6: is it a fact someone could check on the day?

59:00 · two minutes

An initiative card is a promise; monitoring is how you keep it. Four signals, every month. The next gate, which is a fact you can check. The leading measure from box 6. Hours and money against the card, straight from the timesheets. And what changed outside: dependencies and risks.

The rhythm, under them. Monthly, each owner gives one status line to the leadership team. Quarterly, one page for all initiatives goes to the committee, with the lagging measures. Yearly, with the committee, re-score the SAR you used in station 5, re-plan the timeline and retire what is done. Standard 12.2 asks for exactly this: objectives for the function’s performance, and a way to measure progress against them.

Then the color rule, decided in advance so nobody argues about amber, and say one status line aloud (it is in the PDF), for initiative 2 in the third quarter of 2027: gate 2.1 met, the inventory tested; three of the four auditors trained, with the deadline in September. Amber, and the owner says what closes it. One line like that per initiative is the whole monthly report.

1:01:00 · two minutes

Now the initiatives go on one timeline: three years by quarter, one lane per pillar and one for the foundation. The two we just worked are starred.

Four sequencing rules on the right. Dependencies first: there is no analytics without data access, and no AI audit without a method. A quick win inside ninety days, so the committee sees movement at the first meeting after it endorses the strategy: here, the living backlog. Three to five new moves a year in the pillars: 2027 starts five, 2028 three, and 2029 none, because the last year is for embedding. The foundation’s work comes on top of those. And leave room: something will happen that is not on this page.

Notice that the foundation lane starts in the first quarter too. The charter, the methodology and the quality program are not glamorous, and they sit on the critical path of almost everything above them. The diamonds in the bottom row are the committee’s annual checks.

1:03:30 · two and a half minutes

The timeline shows initiatives, and nobody can staff an initiative. So each one is split into projects of three to twelve months: one owner, a deliverable, the hours, and a gate to pass before the next one starts.

Walk initiative 1: data access, then the rules, then a pilot with accounts payable, then scale and hand over. Each gate is a fact, not a feeling: the extract reconciles to the ledger; false positives are under twenty percent; accounts payable owns the exceptions. If a gate fails, the next project waits, and the committee hears it from you first.

Then the band at the bottom: the two initiatives’ project hours fall from about seventeen hundred in 2027 to under five hundred in 2029, because projects end. What they built does not: the monitors and the AI audits move into the plan. That is how a strategy changes the plan instead of competing with it.

1:06:00 · two minutes

This is what “a project” means on the previous page: one card each. The fields that matter most are the ones people skip. “Done when” stops a project from drifting. “Depends on” is where you discover you need the ERP program’s data model frozen before the rules can move across at go-live. And the gate decides whether the next project starts.

Then the right-hand side, which is where most strategies quietly die. Fourteen people give you about nineteen and a half thousand productive hours. If the plan books all of them to engagements in January, the strategy gets the evenings. So reserve the strategy’s hours first: here thirteen percent for projects, the two initiatives’ seventeen hundred and thirty hours and the other moves starting this year, and four percent held back for triggers.

Standard 9.4 covers the plan, and Principle 10 the resources behind it. This page is where the two meet the strategy. And it is how you talk about it: not “we are busy”, but “one hour in eight goes into becoming the function you asked for”.

1:08:00 · two minutes

Every project in our example depends on someone outside internal audit. The business gives data, time and a pilot, and then owns the exceptions, because a rule management relies on is management’s control. IT gives access and extracts. The second line owns the inventories we test. External audit coordinates and relies, both ways: that is Standard 9.5. Specialists cover skills a project needs but a career does not. HR and finance give the roles and the budget line.

At the foot, how to make it real: a RACI line on each project card, agreed with the people named before the plan is approved. Project 1.1: the new data analyst does the work, the head of data and analytics owns it, the IT data owner and the data-protection officer are consulted, the CFO and the committee are informed at the gate.

Standard 11.1 is about building those relationships. The practical test: if a helper first hears about your project when it is late, you asked too late.

1:10:30 · two minutes

The last part of the house, and the one most strategies get wrong by writing it first, from a wish list. Do it last, and read it off the projects: take every project card, list what it needs, and group the needs into six enablers.

Take one, technology and data. Initiative 1 needs a platform and read access to the ERP; initiative 2 needs the AI inventory and the model documentation. That gives its tile a line and a year. Do the same for each and you have the foundation, every line of it traceable to a project.

The Standards under this page: Principle 10 on financial, human and technological resources; 9.3 on methodologies; 9.5 on coordinating with other assurance providers, which is the reliance in the partnerships tile: it is what the combined assurance map in pillar 2 is built on. If the strategy needs a standing right to system data, put it in the charter, which records your mandate (6.2).

1:15:30 · two minutes

Now price the gaps from the last slide by year, and say what pays for it. Four sources, in the order a committee likes to hear them: what you stop, what you re-scope, what you borrow, and only then what you ask for.

The percentages are illustrative; price yours in your own budget. What matters is the shape: the ask is front-loaded, it falls, and it finishes. Every line is tied to a risk the committee already cares about.

Ask for a multi-year line, endorsed once with the strategy. A strategy funded one year at a time turns back into a plan by its second year. Standards 10.1 to 10.3 cover the financial, human and technological resources; this page is how you ask for them.

Your story, if you have one · forty-five seconds. An ask you saw funded because something stopped, or refused because nothing did. What did the committee hear first?

1:17:30 · ninety seconds

Maya’s house, the same one you saw at minute four. Now you have seen how every part of it was made: the roof in part two, the pillars from real inputs in part three, the initiatives, projects and enablers in parts four to six.

Check it bottom-up, out loud, once. Pick “continuous assurance, procure-to-pay”, walk it up to pillar 1, then to “a continuous view” in the vision. Everything on this page should survive that walk.

And this page, not the forty-page document, is what goes to the committee. Which is part seven. No break is timed in; if you need one, take it here, and take the minutes from the questions at the end.

1:19:30 · two minutes

The house is built; now it has to land with the people who endorse it. Committees ask these five questions whether you put them on a slide or not, so answer them before they are asked. Question 5 is the one most chief audit executives forget: say exactly what you need. A strategy noted is not a strategy endorsed.

Then work backwards from the meeting, on the right. Twelve weeks out, interview the chair first: the chair should recognize their own words in your vision. Six weeks out, draft the one page and test it with your team. Three weeks out, pre-wire the chair, the CEO and the CFO, one at a time. Maya’s pre-wire went exactly like this: the CFO’s question about the platform was answered before the meeting, not in it. In the meeting: ten minutes, one page, one decision, minuted.

Consult management widely, but they do not edit the objectives: call 1 in station 2. Standard 9.2 asks for a periodic review with the board, so make it a date in their calendar.

Your story, if you have one · forty-five seconds. A pre-wire that saved a strategy: who you saw, what changed before the meeting, and what would have happened in the room.

1:22:30 · two minutes · Before, After, then In the room

Show Before and ask the room: what decision is this slide asking for? Give the chat ten seconds. None: fourteen bullets on page 7 of 40, and not one ask, target or date.

Switch to After. In September, this is the page Maya’s committee endorsed. Walk the six pins: the headline is the vision, not the document’s name; three pillars, not fourteen bullets; every move has a year; measures with targets, outcomes not activity; the ask, with what stops to fund it; and the decision, named, so it can be minuted. Same strategy. Only one of them gets funded, and it is the second.

Then In the room: ten minutes, in six beats. Why now, one minute: what is changing, its risks, and your ask. Where we are going, two: the vision and the pillars. What changes, two: three shifts the committee will notice. What it takes, two: the moves, the enablers and the ask, priced. How you will know, two: the measures and the review rhythm. And the decision, one: exactly what you need from them today.

Say the ask in the first minute: committees listen differently when they know a decision is coming. Skip the method and the appendix, and never end without asking.

1:24:30 · ninety seconds

Three rhythms: track quarterly, check yearly, rebuild every three years, sooner on a trigger.

Risk in Focus 2026/2027 makes the point bluntly: a plan updated every year but supported by an outdated strategy may still lack the skills, technology, sourcing or methods that emerging risks need.

Point at the triggers. The Cybersecurity Topical Requirement, effective February 2026, is a live example of a regulatory trigger for many functions.

And keep telling it: one strategy, four conversations. The committee asks whether it is covered and whether internal audit is equipped; executives ask what changes for them; the team asks what it means for their roles; assurance partners ask where you will rely on each other. The team hears it first: if they cannot explain it in a sentence, it will not survive contact with the business. That is Standard 11.1, and 9.5 for the partners.

1:29:00 · one minute

Six actions in ninety days, in the order of the session: gather the inputs, build the house, land it. If they do only one thing: book thirty minutes with the committee chair this week. The email to send is on the session page, ready to copy, and you will say it once more at the very end. Maya took six months, around a full audit plan; with the time protected, ninety days is enough.