Topic starter
11/07/2026 8:31 pm
TL;DR: Continuous, engineering-led assurance is the direction of travel, Drata says, with current evidence replacing screenshot-driven audits and annual evidence collection. Identity governance needs live telemetry on access, exceptions, and control ownership for decisions that track runtime reality.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “The Future of GRC with GitLab Security Automation Team Lead & GRC Engineer Founder Ayoub Fandi”.
Key questions
Q: Why do AI tools fail in GRC when the underlying workflow is inconsistent?
A: AI fails when it is asked to summarise unstructured evidence, inconsistent exceptions, or unclear approval logic.
Q: What breaks when compliance is measured only at audit time?
A: Point-in-time compliance misses the gap between evidence collection and real operations.
Q: How should security teams move from access reviews to continuous assurance?
A: Start by linking identity events to policy decisions.
Practitioner guidance
- Implement continuous evidence pipelines Replace screenshot collection with automated evidence feeds from identity, cloud, and governance systems so control status stays current.
- Standardise exception handling in assurance workflows Define how control exceptions are captured, reviewed, approved, and re-opened so AI-assisted triage does not erase context.
- Tie compliance checks to infrastructure-as-code Scan policy, configuration, and identity changes before deployment so compliance is assessed at the same point security is enforced.
Bottom line: GRC engineering reframes compliance as an operating model built on current evidence, not an annual scramble for audit artefacts.
Glossary terms: Continuous Assurance, GRC engineering, Assurance Debt, Trust Center
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 hours ago by NHI Mgmt Group
11/07/2026 9:01 pm
Continuous assurance is now a control design problem, not a reporting problem. Static evidence collection cannot keep pace with cloud change, outsourced operations, or AI-assisted workflows. The article’s core shift is that GRC must consume live control signals if it is to remain credible to auditors, customers, and operators. Practitioners should treat evidence freshness as part of control effectiveness.
A question worth separating out:
Q: How should GRC teams demonstrate accountability in a continuous assurance model?
A: Every key control should have a named owner, a review cadence, and a clear escalation path when the control drifts. That makes the programme defensible and gives security leaders current data rather than periodic status reports.
👉 Read our full editorial: GRC engineering is turning compliance into continuous assurance