Topic starter
25/06/2026 5:16 pm
TL;DR: Audit risk is shaped by inherent risk, control risk, and detection risk, and the article argues that auditors reduce overall exposure by sizing procedures to the weakness of controls, the complexity of transactions, and the likelihood that misstatements will escape review, according to Pathlock. The broader lesson for identity programmes is that weak governance does not remove risk, it shifts where failure shows up and how late it is found.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “What is Control Risk? | Control vs Inherent Risk”.
Key questions
Q: What breaks when segregation of duties is not continuously monitored?
A: Toxic combinations can persist unnoticed in privileged, financial, and regulated-data workflows.
Q: Why do weak controls increase the need for deeper audit testing?
A: Weak controls leave auditors with less reliable evidence that errors or fraud would be stopped in normal operations.
Q: How do teams know if control risk is rising in practice?
A: Control risk is rising when approvals are inconsistent, duties overlap, exceptions are frequent, or reviewers cannot show that controls are operating as designed.
Practitioner guidance
- Map segregation of duties to transaction paths Trace who can create, approve, and post high-risk transactions, then remove combinations that let one role complete the full cycle.
- Re-score control risk after process changes Reassess controls whenever business complexity, system design, or approval routing changes, because inherited risk rises when the workflow changes.
- Increase review depth where controls are weak Use larger samples, more periods, and stronger evidence when control design is immature or operating effectiveness is inconsistent.
Bottom line: The article shows that risk is compounded when inherent exposure, weak controls, and delayed detection line up in the same process.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:51 pm
Control weakness does not eliminate risk, it relocates it: When governance is weak, the failure does not disappear. It moves from prevention to detection, and often from early correction to late-stage discovery after the damage has already influenced reporting or decisions. That makes control design a central identity and governance issue, not just an audit mechanics issue. For practitioners, the question is where failure is allowed to survive, not whether risk exists.
A question worth separating out:
Q: What should organisations prioritise first in a high-risk audit environment?
A: Organisations should prioritise the control points that can still prevent or expose failure before it reaches reporting. That means focusing first on segregation of duties, approval integrity, and evidence quality, then expanding detection procedures where those controls remain weak. The sequence matters because late review cannot fully compensate for poor control design.
👉 Read our full editorial: Audit risk model exposes why control gaps and detection lag matter