Planning for 2027 means examining how geopolitical disruption could affect the resources and relationships an organisation relies on. Internal audit can help boards judge whether their preparations are credible and where further assurance is needed.
A supplier does not need to be based overseas for disruption abroad to affect its ability to deliver. Its materials, transport routes or technology may depend on arrangements that the organisation buying from it has never examined.
As budgets and priorities take shape for the year ahead, those dependencies deserve attention. Decisions about trade, conflict, energy and regulation can reach an organisation through higher costs, interrupted services or changes to the availability of essential supplies. Understanding that exposure makes it possible to prepare a proportionate response.
These connections featured in our Heads of Internal Audit Hub on 11 September. In her horizon-scanning session, Donna Littlechild explored whether familiar risks were changing in speed, scale, interdependence or consequence. The discussion highlighted how geopolitical, supplier, cyber, workforce and financial pressures can combine, and what that means for planning and assurance.
Understand where the pressure will be felt
Risk in Focus 2026/27 places macroeconomic, social and geopolitical uncertainty third among the risks facing organisations. In its survey of 797 Chief Audit Executives across Europe, 51% identified this category as a top-five risk.
The report also highlights an important distinction. Assurance over geopolitical exposure may already be taking place through audits of suppliers, financial management, cyber resilience or governance. The task is to understand whether that work provides a sufficiently connected view of the organisation’s exposure.
For an organisation delivering services mainly within the UK, a useful starting point is to follow its dependencies. Where do essential goods come from? Which providers support its technology? What would happen if a supplier’s costs rose sharply or it could no longer obtain a critical component?
The answers may sit across several teams. Procurement might understand the contract, finance the supplier’s financial position, and operations the consequences of a missed delivery. Bringing those perspectives together can reveal weaknesses that are difficult to see from a single risk register entry.
“Some of the most important assumptions never make it into the risk register. Everyone expects a supplier to keep delivering, or a service to remain available. Planning for the year ahead is a good moment to ask what we are taking for granted.”
Donna Littlechild, Littlechild & Haley
Test what resilience will require
Resilience becomes easier to assess when it is tied to a specific service or objective. The organisation needs to understand what must continue, how much interruption it can tolerate and what it would take to recover.
A continuity plan may name an alternative supplier. That offers limited reassurance until someone has checked whether the alternative has sufficient capacity, can meet the required timescale and depends on a different source of supply. Two suppliers can still share the same underlying vulnerability.
Scenario exercises help expose these assumptions. Consider a disruption that delays essential supplies while replacement costs rise. Which activities would take priority? Who could authorise additional spending? At what point would the organisation need to change its service commitments?
The exercise should leave the organisation with decisions to make and actions to complete. It can also identify where further assurance would be useful before next year’s plans are approved.
The following questions provide a starting point for that discussion:
| Planning area | Question to explore | Evidence of resilience |
|---|---|---|
| Critical suppliers | If a key supplier cannot deliver, which activities are affected first? | Understood dependencies, verified alternatives and realistic recovery times. |
| Financial assumptions | How much variation in costs or income can the organisation absorb? | Tested scenarios, agreed monitoring thresholds and clear decisions about how to respond. |
| Essential services and technology | What would allow essential work to continue during a prolonged interruption? | Exercised continuity arrangements, available resources and evidence that workarounds are usable. |
| Decision-making | Who needs to act, and what would trigger a change of plan? | Named responsibilities, appropriate authority and escalation routes that have been tested. |
Build the response into the year ahead
The findings need to influence the 2027 plan. If maintaining a service depends on additional capacity, a different supplier arrangement or investment in recovery capability, that requirement should be visible in budgets and operational priorities.
There will be trade-offs. Holding more stock has a cost. Maintaining an alternative provider may require commitment before it is needed. Boards need a clear account of those choices, the disruption the organisation could face and the level of risk they are prepared to accept.
Planning assumptions should also have owners and review points. A significant change in a supplier’s financial position, a restriction affecting a trading relationship or a material movement in costs may justify revisiting a decision before the next scheduled planning cycle.
At the September Hub, participants discussed formal checkpoints and contingency capacity to respond to emerging risks. Both are useful, provided the organisation also knows what would prompt an earlier review. A date in the diary cannot cover every change in circumstances.
This is where horizon scanning earns its place in planning. The information collected needs to reach someone who can assess its significance and decide whether action is required.
Focus assurance on the decisions ahead
Management remains responsible for preparing and implementing the organisation’s response. Internal audit can examine whether the assumptions are reasonable, responsibilities are clear and the evidence supports the confidence being expressed to the board.
That may involve reviewing a critical dependency across several functions, observing a scenario exercise or testing whether lessons from previous disruption have been acted on. The scope should follow the potential effect on the organisation’s objectives.
“If the board is relying on a fallback plan, we should be able to explain why it is credible. Has it been tested? Does it still depend on the supplier or system that caused the problem? Those are the questions that help people judge how much confidence to place in it.”
Paul Haley, Littlechild & Haley
Internal audit’s own plan needs enough flexibility to respond. Both the Hub discussion and Risk in Focus point towards more responsive assurance, informed by regular conversations with management and a continuing assessment of changing risks.
Existing assurance should be considered too. Reliable monitoring by operational teams and risk functions may provide evidence that internal audit can assess and use, helping direct limited resources towards the areas where independent examination will add most value.
Before finalising the year-ahead plan, three questions deserve a place in the discussion:
- Which assumptions about suppliers, resources and operating conditions are most important to delivering our objectives?
- What evidence shows that our response would work if those assumptions fail?
- What changes would cause us to revisit our plans, and who would make that decision?
Working through those questions can reveal where preparations need strengthening and where the board already has good grounds for confidence. It also gives internal audit a practical basis for deciding what assurance is needed as the year unfolds.
At Littlechild & Haley, these are conversations we continue through our Heads of Internal Audit Hub and our work with organisations on governance, risk and assurance. They provide a useful starting point for planning a resilient year ahead.
