Topic starter
08/06/2026 4:26 pm
TL;DR: A survey of 1,000 financial and fintech professionals found 88.4% are very confident they would pass a surprise audit, yet 64% of financial services companies have received an identity-related audit citation in the past two years and 49.3% still spend 10 to 25 hours a month preparing audit data, according to StrongDM. The gap is not confidence but provability: compliance programmes that cannot produce timely access evidence are already behind.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “The State of Compliance in Financial Institutions Report by StrongDM”.
By the numbers:
- 88.4% of respondents said they are very confident their organisation would pass a surprise compliance audit.
- 64% of financial services companies have received an identity-related audit citation in the past two years.
- 49.3% still spend 10 to 25 hours monthly preparing audit data.
Key questions
Q: What breaks when compliance teams cannot produce audit evidence quickly?
A: When teams cannot produce evidence quickly, the control may exist on paper but not in an examinable form.
Q: Why do financial institutions struggle with least privilege during audits?
A: They struggle because least privilege is hard to prove across changing access, delegated approvals, and multiple systems.
Q: How do teams know whether their audit automation is actually working?
A: It is working when evidence is current, exceptions are detected in the same cycle they occur, and reconciliation errors fall rather than accumulate.
Practitioner guidance
- Automate audit evidence capture Build evidence generation into access workflows so approvals, grants, revocations, and log events are retained as system records rather than reconstructed manually during audit prep.
- Measure revocation latency Track how long it takes to remove access after role changes or exit events, then compare that figure to the systems and privilege levels that appear in audit findings.
- Tighten privileged access logging Ensure elevated access to high-risk systems produces durable records that show who accessed what, when, and under which entitlement, with no reliance on screenshots or spreadsheets.
Bottom line: The report shows a clear gap between compliance confidence and the ability to produce defensible audit evidence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 6:03 pm
Audit confidence is not the same as audit evidence: The report shows a programme can feel ready while remaining unable to prove access control outcomes under scrutiny. That is a governance failure because regulated environments require reconstructable evidence, not just documented intent. Financial institutions should treat proof generation as a first-class control outcome, not an afterthought.
A question worth separating out:
Q: When should organisations extend PAM controls to non-human identities?
A: Organisations should extend PAM as soon as service accounts, API keys, certificates, or automation identities can perform privileged actions. If those identities can modify infrastructure, access sensitive data, or bypass approval workflows, they need the same lifecycle discipline as human admins. Waiting until an incident creates avoidable risk.
👉 Read our full editorial: Compliance confidence is outpacing audit evidence in financial institutions
This post was modified 4 days ago by NHI Mgmt Group