Topic starter
25/06/2026 12:57 am
TL;DR: COSO’s five-component internal control framework remains the core language for designing, testing, and evidencing control effectiveness across financial reporting, access governance, and monitoring, according to Pathlock. The practical lesson is that IAM, NHI, and compliance teams need one connected control model, not isolated checks that fail when ownership, evidence, or review cadence breaks down.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “Guide to Five Components of Internal Controls”.
Key questions
Q: Where do COSO controls most often fail in identity governance programmes?
A: They usually fail where approvals, ownership, and evidence are split across different teams or tools.
Q: Why does overlap in access rights make segregation of duties ineffective?
A: Overlapping access lets the same person move through multiple checkpoints without independent review.
Q: How can organisations tell whether continuous monitoring is actually improving control?
A: Look for fewer unexplained exceptions, faster remediation of access drift, and cleaner alignment between monitored signals and control owners.
Practitioner guidance
- Map critical access paths to COSO components Link each privileged or sensitive access path to the specific COSO component it supports, then document the approval, evidence, and monitoring points that prove it operates as designed.
- Formalise segregation of duties for sensitive actions Identify where one identity can initiate, approve, and execute the same high-risk transaction, then separate those duties across distinct roles and review points.
- Standardise control evidence collection Define a repeatable evidence package for access reviews, exceptions, and remediation so audit requests do not require manual reconstruction from multiple systems.
Bottom line: COSO remains relevant to identity governance because access, approvals, and monitoring are part of the control system, not separate support tasks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:05 am
COSO still matters because control design is an identity governance problem, not only an accounting one. The article’s relevance to IAM and NHI teams is that access approvals, review cadence, and evidence collection are the operational expression of internal control. When those functions are disconnected, the organisation can appear compliant while still lacking a governable control model. The practical conclusion is that identity governance must be treated as part of the control architecture, not a separate administrative layer.
A question worth separating out:
Q: What should IAM and compliance teams do first when COSO mapping is incomplete?
A: Start with the highest-risk access and transaction paths, then map each one to the COSO component that governs ownership, approval, evidence, and review. The first goal is not to document everything at once, but to identify where critical processes lack an accountable control owner or a repeatable evidence trail.
👉 Read our full editorial: COSO internal controls still matter for identity governance