The technology risk universe of almost any organisation is inherited. It carries over from last year, the committee's requests get added, and the result is split into hours. That usually produces a plan that covers what was already known and leaves out what has changed.

Before allocating hours it is worth answering eight questions by area. They do not replace the risk assessment, they order it. And they can be answered in one session with the team, without asking anyone for data.

  1. Governance. Who formally owns looking at technology as a whole, and when that mandate was last reviewed.
  2. Systems. Whether an application inventory with owners exists, and how many of them hold up a critical process without having one.
  3. Suppliers. Which suppliers can enter the systems or touch the data, and how many of those accesses were reviewed this year.
  4. Access. When someone leaves, what evidence remains that their access was closed and how long it took.
  5. Data. What personal data is processed, where it sits and who can see it without leaving a trace.
  6. Cybersecurity. What the committed recovery time is and when it was last tested with a real restore.
  7. Change. Which changes reached production last quarter without the approval the procedure requires.
  8. Artificial intelligence. Which processes already use AI, approved or not, and who answers for those decisions.

Every "I don't know" is information, not a failure. It marks where the organisation cannot demonstrate today what it assumes it controls, which is exactly where an audit engagement pays off most.

A plan does not fail by covering little. It fails by covering the usual.

What to do with the answers

Rank the eight areas on two axes, how much the business depends on that area and how much evidence exists today. Whatever sits top right, high dependency and low evidence, goes into the plan even if it was not there last year. The rest is scheduled or justified in writing.

That crossing is what orders the cycle, and it matches what teams say they are going to audit this year.

The plan that holds up in front of the committee is not the one covering the most areas. It is the one that explains why it left the others out.