Notifications
Clear all
Topic starter
25/06/2026 12:08 am
TL;DR: Periodic audit testing and spreadsheet-driven controls leave long gaps before failures are found, while SafePaaS says automated users report a 76% reduction in retesting costs for failed controls. Manual audit models are now a governance liability because assurance, evidence, and remediation have to move continuously, not quarterly.
NHIMG editorial — based on content published by SafePaaS: Audit is undergoing a seismic transformation
By the numbers:
- a North American healthcare provider cut its audit evidence preparation time by 70%
Questions worth separating out
Q: How should security teams move from periodic audits to continuous assurance?
A: Start by identifying the controls that create the most exposure when they fail late, especially access approvals, privileged access, and segregation of duties.
Q: Why do manual audit processes create so much operational risk?
A: Manual audit processes rely on people to assemble evidence after the fact, which creates delays, inconsistency, and blind spots.
Q: How do teams know whether continuous controls monitoring is working?
A: Look for faster exception detection, shorter remediation times, fewer repeat findings, and evidence that can be retrieved without manual reconstruction.
Practitioner guidance
- Move high-risk access controls to continuous validation Start with privileged access, segregation of duties, and sensitive provisioning workflows.
- Centralise evidence for audit-ready access decisions Bring approvals, exceptions, remediation status, and ownership metadata into one evidence layer so auditors do not have to reconstruct control history from ERP, HR, finance, and ITSM exports.
- Automate retesting for recurring control failures Define repeatable fixes for the control breaks that keep reappearing, such as SoD conflicts or unapproved access changes, and capture the outcome so the same issue does not return at the next review cycle.
What's in the full article
SafePaaS's full article covers the operational detail this post intentionally leaves for the source:
- Daily control-testing workflow examples for ERP, HR, finance, and ITSM environments
- Dashboard and reporting patterns for board-ready continuous assurance programmes
- Evidence-management mechanics for reducing audit prep time and retesting overhead
- Policy-driven enforcement examples for segregation of duties, privilege access, and related control sets
👉 Read SafePaaS's article on continuous audit assurance and control automation →
Continuous assurance in audit: what IAM and control teams need to know?
Explore further
25/06/2026 8:58 am
Continuous assurance is now an identity governance requirement, not an audit preference. When access, entitlement, and SoD evidence still lives in manual review cycles, the organisation is operating with a built-in delay between control failure and control awareness. That delay is the real risk, because audit findings are only the visible symptom. Practitioners should treat continuous validation as part of access governance maturity, not as a reporting enhancement.
A few things that frame the scale:
- organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, which helps explain why control consistency remains difficult.
A question worth separating out:
Q: Who should own evidence and remediation when audit findings affect access controls?
A: Ownership should sit with the control operator, but the governance model should clearly define who validates evidence, who approves remediation, and who closes the exception. In identity programmes, that usually means IAM, PAM, and audit teams sharing a common control model so no one can defer responsibility when a failure appears.
👉 Read our full editorial: Continuous audit assurance is replacing periodic control testing
