Topic starter
25/06/2026 12:08 am
TL;DR: Periodic audit testing and spreadsheet-driven controls leave long gaps before failures are found, while SafePaaS says automated users report a 76% reduction in retesting costs for failed controls. Manual audit models are now a governance liability because assurance, evidence, and remediation have to move continuously, not quarterly.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “How Audit Leaders are Achieving Continuous Assurance and Reducing Audit Surprises Year-Round”.
Key questions
Q: How should security teams move from access reviews to continuous assurance?
A: Start by linking identity events to policy decisions.
Q: Why do manual audit processes create so many control blind spots?
A: Manual processes depend on people collecting evidence, reconciling systems and checking samples at a fixed point in time.
Q: What are the best ways to reduce retesting costs after a control failure?
A: Centralise evidence, automate recurring checks and standardise the way exceptions are validated so every retest does not start from scratch.
Practitioner guidance
- Automate high-risk control testing Start with controls that fail most visibly when they go unchecked, including user provisioning, access management and transaction-level monitoring.
- Centralise audit evidence across systems Pull evidence out of ERP, HR, finance and ITSM silos into a single operating view so exceptions, review results and remediation status are available without manual chase work.
- Replace sample-based review with full-population analytics Use analytics to examine all relevant transactions or access events where control failure is unacceptable, instead of relying on a small sample that may miss the issue entirely.
Bottom line: Periodic review models leave too much time between a control failure and its discovery, which is why manual audit programmes struggle to keep pace.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:58 am
Continuous assurance is becoming the operating model for modern control governance. The article describes a shift away from periodic sampling toward always-on evidence, which changes audit from a review function into a live governance layer. That matters because control failures no longer respect quarterly or annual cadences. Practitioners should treat assurance latency as a governance risk in its own right.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: What happens when segregation of duties issues are only found at year-end?
A: The organisation usually enters a remediation scramble that consumes time, elevates audit scrutiny and weakens stakeholder confidence. Late discovery also means the control failure may have existed throughout the year, increasing the chance of downstream impact. Continuous monitoring limits that exposure by surfacing conflicts earlier in the control cycle.
👉 Read our full editorial: Continuous audit assurance is replacing periodic control testing