Notifications
Clear all
Topic starter
24/06/2026 11:27 pm
TL;DR: Internal controls reduce fraud, limit misuse, and improve accountability by combining preventive, detective, and corrective measures across financial and operational processes, according to Pathlock. The same control logic now applies to NHI, human access, and delegated workflows, where standing privilege and weak review cycles turn convenience into exposure.
NHIMG editorial — based on content published by Pathlock: Internal controls and fraud prevention checklist
By the numbers:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
Questions worth separating out
Q: How should teams apply internal controls to identity governance?
A: Treat identity governance as a control system, not a paperwork exercise.
Q: Why do excessive privileges increase fraud and misuse risk?
A: Excessive privileges create a wider action surface for both insiders and attackers.
Q: How do organisations know whether internal controls are actually working?
A: They work when activity, approval, and reconciliation consistently line up.
Practitioner guidance
- Separate request, approval, and reconciliation paths Ensure no single human user or non-human identity can initiate, approve, and verify the same sensitive transaction.
- Review privilege scope against actual job need Inventory accounts, service identities, and delegated processes that can touch financial, administrative, or sensitive operational workflows.
- Reconcile usage with entitlement on a fixed cadence Compare access grants, logged activity, and approved business purpose on a recurring schedule.
What's in the full article
Pathlock's full article covers the practical internal control checklist this post intentionally leaves for the source:
- Detailed segregation-of-duties examples across cash handling, payroll, and purchasing workflows
- Practical reconciliation steps for bank accounts, petty cash, and credit card statements
- Board oversight responsibilities for approving policy, reviewing variances, and meeting audit expectations
- Stepwise fraud-prevention checklist items that operational teams can adapt to their own process controls
👉 Read Pathlock's internal controls checklist for fraud prevention →
Internal controls and access governance: what teams are missing?
Explore further
25/06/2026 8:20 am
Controls are the governance layer that identity programmes often simulate but do not consistently operationalise. The article shows that policies only matter when they are embedded into workflow, review, and enforcement. In identity governance, that means access should not depend on trust, memory, or informal approval chains. The practitioner lesson is that control design must be measurable, not aspirational.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means most identity programmes cannot reliably prove what access exists.
A question worth separating out:
Q: Who should be accountable when controls fail?
A: Accountability should sit with the control owner, the process owner, and the approving manager, depending on where the failure occurred. If a workflow lets one identity bypass separation of duties, the failure is structural, not just personal. That means governance must assign ownership for fixing the process, not only for disciplining the person involved.
👉 Read our full editorial: Internal controls are the missing identity governance layer
