Notifications
Clear all
Topic starter
25/06/2026 1:05 am
TL;DR: COSO remains the standard reference point for internal controls, but the article shows why governance still fails when organisations treat controls as static rather than continuously tested, updated, and embedded across reporting, compliance, and operations, according to Pathlock. The lesson is that control design without monitoring discipline and clear accountability still leaves material fraud and reporting risk unresolved.
NHIMG editorial — based on content published by Pathlock: COSO Framework for Internal Controls
Questions worth separating out
Q: How should security teams apply COSO principles to identity governance?
A: Treat identity governance as a control system with ownership, monitoring, and independent review, not as an access administration queue.
Q: What breaks when the same team can approve and certify access?
A: Control independence breaks.
Q: How do you know if identity monitoring is actually working?
A: Monitoring is working when exceptions surface quickly, owners are assigned, and deficiencies are corrected before the next review cycle.
Practitioner guidance
- Map identity controls to COSO objectives Separate access governance into operations, reporting, and compliance outcomes so you can see which control failures affect service continuity, audit evidence, or regulatory exposure.
- Enforce segregation of duties in access workflows Prevent the same role from approving, provisioning, and certifying sensitive access without independent review, especially for privileged and exception-based access.
- Move monitoring ahead of periodic review Use ongoing exception detection for stale access, failed recertifications, and unowned entitlements so deficiencies are visible before the next access review cycle.
What's in the full article
Pathlock's full article covers the control-model detail this post intentionally leaves for the source:
- Detailed explanation of the five COSO components and how each maps to control design
- Expanded walkthrough of the COSO cube across organisation, business unit, and function levels
- Examples of COSO extensions into sustainability reporting, healthcare, blockchain, and automation
- The article's own FAQ section on implementation steps, fraud prevention, and SOX alignment
👉 Read Pathlock's COSO framework analysis for internal controls and governance →
COSO internal controls: where governance breaks when risks shift?
Explore further
25/06/2026 10:15 am
COSO remains relevant to identity governance because access control is a control system, not a workflow. The article’s strongest contribution is its reminder that authorisation, review, monitoring, and escalation are meant to work together, not as separate administrative steps. That maps directly to IAM, PAM, and NHI governance, where the programme fails if entitlement decisions are not independently checked. Practitioners should treat access control as part of the internal control environment, not a standalone administrative process.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who should be accountable when access control deficiencies are found?
A: Accountability should sit with the control owner who can fix the issue, the risk owner who accepts residual exposure, and the governance function that verifies escalation when remediation stalls. COSO works only when deficiencies are reported to the right authority fast enough to change outcomes.
👉 Read our full editorial: COSO internal controls show why governance still fails under change
