COSO internal controls still matter for identity governance

At a glance

What this is: This is Pathlock’s explanation of COSO internal control components and the finding that the framework still matters because identity governance, audit evidence, and monitoring only work when they are connected.

Why it matters: IAM, NHI, and compliance teams can use COSO to align access controls, accountability, and continuous monitoring into one governance model instead of scattered checks.

Context

COSO internal controls are a governance framework for designing, operating, and evaluating the controls that support reliable reporting, compliance, and accountability. In this article, the primary identity security connection is not the framework itself, but the way access control, segregation of duties, and monitoring must be wired into business processes if control evidence is going to stand up to audit.

The article’s core point is that COSO remains useful because companies often interpret the five components differently across systems and processes. That matters to IAM and NHI teams because internal control breaks down when ownership, approvals, evidence, and review cadence are managed separately instead of as one operating model.

Key questions

Q: Where do COSO controls most often fail in identity governance programmes?

A: They usually fail where approvals, ownership, and evidence are split across different teams or tools. COSO assumes control components reinforce one another, so an access review without clear accountability or timely remediation becomes documentation, not control. IAM and NHI teams should look for gaps where one process exists in isolation and cannot prove who acted, why they acted, and what happened next.

Q: Why does overlap in access rights make segregation of duties ineffective?

A: Overlapping access lets the same person move through multiple checkpoints without independent review. That removes the second set of eyes SoD depends on and makes the process self-confirming. In practice, the more privilege overlap you allow, the less SoD behaves like a control and the more it behaves like documentation.

Q: How can organisations tell whether continuous monitoring is actually improving control?

A: Look for fewer unexplained exceptions, faster remediation of access drift, and cleaner alignment between monitored signals and control owners. If monitoring only creates more alerts or better reports, it is helping visibility but not governance. The strongest signal is that changes in access state trigger timely review and action.

Q: What should IAM and compliance teams do first when COSO mapping is incomplete?

A: Start with the highest-risk access and transaction paths, then map each one to the COSO component that governs ownership, approval, evidence, and review. The first goal is not to document everything at once, but to identify where critical processes lack an accountable control owner or a repeatable evidence trail.

Technical breakdown

Why COSO control environment still shapes access governance

The control environment is the foundation that determines whether access governance is taken seriously or treated as a technical afterthought. COSO ties this to tone at the top, authority assignment, competence, and independent oversight, which is why identity controls fail when ownership is unclear or leadership tolerates exceptions. In practice, the strongest access model can still collapse if the organisation does not define who approves, who reviews, and who is accountable for exceptions.

Practical implication: align IAM and PAM ownership with board-visible accountability, not just system administration.

How control activities map to segregation of duties and access reviews

Control activities are the policies and procedures that make management directives real, and the article explicitly includes authorisation, reconciliation, separation of duties, performance reviews, and access controls. For identity teams, that means the control is not the review alone but the full chain from approval to evidence to exception handling. Continuous monitoring and automated workflows help, but only if the control activity is designed so that no single person can both create and approve high-risk access.

Practical implication: map each critical access path to a documented SoD rule and a repeatable evidence trail.

Why information and communication determines whether controls can be audited

COSO treats information and communication as the mechanism that lets people understand and execute their control responsibilities. For identity programmes, that means dashboards, alerts, control narratives, and policy exceptions must be delivered in a format that auditors, process owners, and control operators can all use. If the organisation cannot explain what happened, when it happened, and who was responsible, the control may exist but it will not be evidence-ready.

Practical implication: standardise control evidence formats so access, risk, and remediation data can be reused across audit and operations.

Threat narrative

Attacker objective: The objective is to exploit governance gaps so control failures are hidden long enough to affect reporting integrity and compliance confidence.

1. Entry occurs when access and control ownership are not clearly assigned, allowing weak governance to persist unnoticed across business processes.
2. Escalation occurs when segregation of duties, approvals, and review responsibilities are handled as separate tasks rather than one connected control model.
3. Impact follows when control exceptions cannot be evidenced, monitored, or remediated quickly enough to support reliable reporting and compliance.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

COSO still matters because control design is an identity governance problem, not only an accounting one. The article’s relevance to IAM and NHI teams is that access approvals, review cadence, and evidence collection are the operational expression of internal control. When those functions are disconnected, the organisation can appear compliant while still lacking a governable control model. The practical conclusion is that identity governance must be treated as part of the control architecture, not a separate administrative layer.

Segregation of duties is the clearest bridge between COSO and non-human identity governance. COSO names separation of duties as a core control activity, and that maps directly to how privileged access, service accounts, and approval workflows should be constrained. The lesson is not simply to add another review, but to ensure no identity path can create, approve, and execute the same sensitive action without independent oversight.

Continuous monitoring is now the difference between documented control and usable control. The article makes clear that periodic testing alone is not enough when business processes and technology change faster than annual assessment cycles. This is where control effectiveness becomes a live governance question: if exceptions are not visible in time, the framework exists on paper but not in operations.

Control evidence is the named concept that many IAM programmes still underbuild. COSO depends on information and communication, yet many identity programmes focus on enforcement while underinvesting in repeatable evidence. That leaves audits dependent on manual reconstruction and weakens confidence in both access governance and financial control. Practitioners should treat evidence design as part of the control, not a post hoc reporting exercise.

Identity governance becomes stronger when it is measured as a connected system. COSO’s five components only work when tone, risk, activity, communication, and monitoring reinforce one another. For IAM and NHI teams, that means the question is not whether a control exists, but whether it can be owned, explained, tested, and remediated across the full lifecycle. The practical conclusion is to move from isolated checks to integrated control design.

What this signals

Control evidence is the pressure point for modern identity governance. COSO-based programmes break down when access approvals, review results, and remediation notes cannot be traced back to a single control owner. That means identity teams need evidence design built into the process, not bolted on for audit season.

Segregation of duties is where internal control and identity governance converge most clearly. If a service account, privileged role, or approval workflow can both trigger and approve a sensitive action, the organisation has a control design problem rather than a tooling problem. The governance answer is to make the control path demonstrably independent.

Continuous monitoring matters because static assessment cannot keep pace with changing business systems. A control can be written correctly and still drift out of effectiveness as roles, systems, or exceptions change. Practitioners should watch for control models that produce reports but cannot support timely remediation.

For practitioners

• Map critical access paths to COSO components Link each privileged or sensitive access path to the specific COSO component it supports, then document the approval, evidence, and monitoring points that prove it operates as designed.
• Formalise segregation of duties for sensitive actions Identify where one identity can initiate, approve, and execute the same high-risk transaction, then separate those duties across distinct roles and review points.
• Standardise control evidence collection Define a repeatable evidence package for access reviews, exceptions, and remediation so audit requests do not require manual reconstruction from multiple systems.
• Increase monitoring frequency for control failures Replace annual-only validation with ongoing checks for exceptions, stale approvals, and unresolved remediation items so control drift is detected before audit findings accumulate.

Key takeaways

• COSO remains relevant to identity governance because access, approvals, and monitoring are part of the control system, not separate support tasks.
• The article shows that internal control only works when accountability, communication, and evidence are connected across the full process.
• IAM and compliance teams should focus on segregation of duties, repeatable evidence, and continuous monitoring to make control design auditable.

Key terms

• Control Environment: The control environment is the foundation of internal control. It includes leadership behaviour, ethical standards, governance structure, competence, and accountability, all of which determine whether the rest of the control system is taken seriously and applied consistently across the organisation.
• Control Activities: Control activities are the policies and procedures that make management directives real. They include approvals, reconciliations, segregation of duties, verifications, and access controls, and they work best when tied directly to the business processes that create risk.
• Information and Communication: Information and communication is the control component that ensures the right people receive accurate, timely, and usable information about their responsibilities. In identity and compliance programmes, it is what makes control ownership, exceptions, and remediation visible enough to govern.
• Monitoring Activities: Monitoring activities are the ongoing checks that confirm controls continue to work as the organisation changes. They include continuous assessments, exception review, and remediation tracking, and they are essential when access and privilege drift faster than periodic audit cycles.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.