COSO internal controls show why governance still fails under change

At a glance

What this is: This is an analysis of COSO internal controls that argues governance fails when control environments do not adapt to changing risks, reporting demands, and operating conditions.

Why it matters: It matters because IAM, NHI, and broader governance teams all depend on controls that are monitored, reassessed, and tied to accountable action rather than left as static policy.

Context

COSO internal controls are a governance model for designing, operating, and monitoring controls across reporting, compliance, and operations. The article’s central point is that a framework only works when it is refreshed as risks, technology, and organisational conditions change.

That matters to identity practitioners because control failures rarely begin with a missing policy. They begin when ownership, review cadence, communication, and monitoring no longer match how access, transactions, and systems actually behave.

The article treats financial reporting and broader governance as the main lens, but the control lesson is general. Static controls fail under change, whether the control object is a ledger, an application, or an identity lifecycle process.

Key questions

Q: What breaks when COSO controls are treated as static after business change?

A: Controls lose assurance when the operating environment changes but ownership, review cadence, and escalation paths do not. The result is a gap between documented control design and real workflow behaviour, which allows reporting errors, compliance misses, and fraud risk to persist longer than intended.

Q: When should organisations prioritise continuous testing over periodic assessments?

A: Organisations should prioritise continuous testing when asset turnover, cloud change, or third-party integration volume makes scheduled reviews too slow to stay current. If the attack surface can change daily, a quarterly or monthly test can miss the most relevant exposure window. That is especially true for identity-linked access paths and externally reachable services.

Q: What are the signs that a control environment is failing in practice?

A: Common warning signs include unclear control ownership, missing or delayed testing evidence, recurring remediation items, and controls that exist on paper but are not embedded in daily work. If dashboards cannot show current status or exceptions keep surfacing during audits, the environment is likely operating reactively rather than under continuous oversight.

Q: How does segregation of duties support COSO governance in practice?

A: Segregation of duties reduces the chance that one person can both initiate and conceal a control failure. In practice, it separates approval, recording, and reconciliation so errors and misuse are more likely to be detected before they affect reporting or operations.

Technical breakdown

Why static control design fails under changing risk

COSO treats internal control as a system, not a document. The five components, control environment, risk assessment, control activities, information and communication, and monitoring activities, only work when they are continuously aligned to the current operating context. Once an organisation assumes yesterday’s control design still fits today’s workflow, control gaps appear in authorisation, reconciliation, reporting, and oversight. That is why COSO’s monitoring principle matters as much as the original design. The failure mode is not absence of a framework, but governance drift between the framework and the business reality it is supposed to govern.

Practical implication: reassess whether each control still matches current processes, systems, and risk conditions before treating it as effective.

How COSO links accountability to control effectiveness

A core COSO theme is that controls only work when responsibilities, authority, and reporting lines are clear. The article highlights defined structure, segregation of duties, board oversight, and timely reporting of deficiencies as essential to preventing management override and unresolved weaknesses. In practice, that means controls fail when accountability is diffuse or when exceptions are known but not escalated. COSO is therefore as much about decision rights and communication as it is about procedure. Without explicit ownership, even well-designed controls can decay into performative compliance that does not change outcomes.

Practical implication: map every key control to a named owner, escalation path, and review cadence so deficiencies cannot sit unresolved.

Why continuous monitoring matters more than periodic review

The article’s strongest operational point is that periodic assessment alone is no longer enough in a changing environment. COSO’s monitoring activities are meant to detect control deficiencies early, classify their severity, and report them to the right authority before they compound. That principle is especially important when controls touch fast-moving business processes, automated workflows, or technology-dependent reporting. The control question is not whether a test passed once, but whether the control still functions as business conditions shift. This is where many governance programmes become brittle: they keep certifying an old state instead of observing a live one.

Practical implication: combine ongoing monitoring with separate evaluations so control failures surface as operating conditions change, not after a reporting cycle closes.

Threat narrative

Attacker objective: The objective is to exploit governance drift so inaccurate reporting, weak oversight, or fraudulent activity can continue without timely challenge.

1. Entry occurs when control assumptions no longer match the current process, so errors or misuse move through an unchanged control environment undetected.
2. Escalation follows when weak ownership, poor segregation of duties, or delayed deficiency reporting allows exceptions to persist beyond their intended scope.
3. Impact appears in unreliable reporting, compliance exposure, operational inefficiency, and in some cases fraud or management override that the controls were meant to prevent.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Governance failure under change is the real COSO problem: the framework is not defeated by absence, but by organisations treating controls as fixed artefacts while risks, processes, and systems keep moving. COSO’s own model depends on monitoring, communication, and evaluation, which means the control system must be able to change as quickly as the business environment does. The practitioner takeaway is that control design must be revalidated against real operating conditions, not merely documented once.

Control ownership is the difference between design and assurance: COSO repeatedly ties effective control to clear authority, responsibility, and escalation. When a control deficiency is observed but not assigned, the organisation has process language without governance substance. That creates a structural gap in accountability, and the practical implication is that every material control needs a named owner who can act on exceptions.

Static periodic testing is a poor fit for dynamic operations: the article’s emphasis on ongoing evaluation reflects a broader shift from point-in-time assurance to continuous observation. Periodic review can confirm that a control once worked, but it cannot prove that the control still matches live workflows, system changes, or reporting pressure. The implication is that monitoring cadence must be built around business change, not audit convenience.

Information and communication are control mechanisms, not support functions: COSO treats upward, downward, and lateral communication as part of internal control because unresolved defects often persist when people do not know what changed or who must respond. That means a governance programme fails when exception handling, incident escalation, and reporting lines are unclear. The practitioner conclusion is that communication paths must be designed with the same care as the control itself.

Continuous control adaptation is now the defining COSO maturity signal: the article’s future-facing guidance points toward systems that identify emerging risk and adjust control behaviour accordingly. That does not mean every control should be automated; it means the control architecture must be capable of responding to change without waiting for annual remediation. The practitioner implication is to judge maturity by how quickly a control system absorbs change and restores assurance.

What this signals

Control drift is the hidden failure mode in most governance programmes: organisations often keep the framework but lose alignment between policy, process, and how work is actually performed. When that happens, internal control becomes a reporting artefact instead of an operational safeguard.

Continuous monitoring is the maturity threshold that matters: the article’s real lesson is that governance only stays credible when deficiencies are surfaced quickly and assigned to accountable owners. For practitioners, the question is not whether controls exist, but whether they still respond when conditions change.

For practitioners

• Revalidate control design after business change Review whether control objectives, owners, and review cycles still match current processes after reorganisations, system changes, or reporting shifts.
• Assign explicit accountability for each material control Document who owns each control, who reviews exceptions, and who receives escalation when a deficiency is found.
• Increase monitoring cadence for high-change processes Use ongoing evaluations for controls tied to fast-moving operations, while reserving periodic reviews for lower-volatility areas.
• Test segregation of duties and approval paths Check whether authorisation, recording, and reconciliation duties are still separated in practice, especially where automation or shared services have changed the workflow.

Key takeaways

• COSO is not failing as a framework. It fails when organisations stop updating controls as risks, systems, and operating conditions change.
• The article ties weak internal controls to historic fraud, reporting failures, and the need for better monitoring and accountability.
• Practitioners should focus on ownership, escalation, and continuous evaluation so control assurance keeps pace with business change.

Key terms

• Control Environment: The control environment is the foundation of internal control. It includes leadership behaviour, ethical standards, governance structure, competence, and accountability, all of which determine whether the rest of the control system is taken seriously and applied consistently across the organisation.
• Monitoring Activities: Monitoring activities are the ongoing checks that confirm controls continue to work as the organisation changes. They include continuous assessments, exception review, and remediation tracking, and they are essential when access and privilege drift faster than periodic audit cycles.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Internal Control Weakness: A failure in the design, implementation, or operation of a control so it cannot reliably prevent or detect problems. In identity programmes, this often shows up as missed approvals, incomplete reviews, or delayed revocation that makes access governance less trustworthy.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.