Join our Newsletter — 33% off our NHI Course
Home› Glossary› Cyber Security› Going Concern Assumption
Cyber Security

Going Concern Assumption

← Back to Glossary
By NHI Mgmt Group Updated October 31, 2026 Domain: Cyber Security

The going concern assumption is the expectation that a company will continue operating for the foreseeable future. Auditors assess whether that assumption is reasonable based on available evidence, liquidity, liabilities, and business outlook. If the assumption is weak, financial statements may need stronger disclosure or a different presentation of risk.

What the going concern assumption means in practice

The going concern assumption is not just an accounting phrase, it sets the baseline for how auditors, management, lenders, and investors interpret the company’s ability to keep operating. It assumes the business can meet obligations, preserve access to funding, and continue normal activity for the foreseeable future unless the evidence says otherwise.

That matters because the assumption shapes whether the financial statements describe an operating business or a business facing material doubt. When the assumption becomes questionable, the issue is less about a single bad quarter and more about whether the organisation can sustain itself through ordinary trading, refinancing, or restructuring.

Why auditors focus on liquidity and obligations

Auditors test the assumption by looking at available evidence, especially cash flow, debt maturities, covenant pressure, refinancing needs, and any sign that liabilities may outpace resources. The point is not to predict the future perfectly, but to assess whether management’s expectation is supportable at the reporting date.

Auditors also look for conditions that can undermine the assumption quickly, such as sustained operating losses, tight working capital, or dependence on short-term funding. A company may remain solvent on paper yet still face going concern pressure if it cannot convert assets into cash fast enough to meet near-term commitments.

Because the assessment is evidence-driven, the quality of the underlying forecasts matters. A weak going concern case often shows up not as a single red flag, but as a pattern of optimistic assumptions that do not align with funding reality or business performance.

Disclosure, presentation, and market signalling

When the assumption is strained, the financial statement response depends on how severe the uncertainty is and how much management can support its forecast. Stronger disclosure may be needed to explain the conditions, the plans to address them, and the judgments behind the conclusion.

If the doubt is significant, the statement presentation can change the way readers understand the company’s risk profile. That does not automatically mean failure is certain, but it does mean stakeholders need clearer information about the timing, severity, and possible consequences of the pressure.

This is why going concern disclosure is often as important as the conclusion itself. It tells users whether management sees a credible path forward, and whether the company’s survival depends on actions that are already underway or still uncertain.

What a weak assumption usually points to

A weak going concern assumption usually reflects deeper business stress, not just an accounting issue. It can indicate a funding gap, an imbalance between obligations and cash generation, a deteriorating operating model, or a dependence on support that may not arrive in time.

For readers, the practical signal is that the company’s risk has moved from ordinary performance volatility into continuity risk. That makes the assumption a useful diagnostic for assessing whether the organisation is stable, fragile, or already requiring restructuring support.

Risk and Threat Considerations

A fragile going concern position increases exposure to sudden financing failure, covenant breach, supplier pressure, and loss of stakeholder confidence. Even without malicious activity, the business can enter a self-reinforcing decline if weak disclosure, delayed action, or overly optimistic forecasts hide the true funding gap.

Failure mechanism: Management overstates liquidity, understates liabilities, or relies on uncommitted funding, so the company appears stable until cash shortages or missed obligations force a rapid correction.

Impact: The result can be emergency restructuring, distressed asset sales, accelerated creditor action, or a shift in how the financial statements must present uncertainty and risk.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

FrameworkControl / ReferenceRelevance
NIST CSF 2.0GV.RM-01 — Risk Management StrategyGoing concern depends on evaluating enterprise financial and operational risk.
GV.OV-01 — OversightBoard and senior oversight are central to approving judgments that affect continuity disclosures.
Recommendation — Incorporate going concern indicators into enterprise risk appetite and escalation decisions. Require governance oversight of management's going concern assessment and supporting evidence.
ISO/IEC 27001:2022A.5.31 — Legal, statutory, regulatory and contractual requirementsGoing concern disclosures are governed by reporting and contractual obligations.
A.5.36 — Compliance with policies, rules and standards for information securityThe term is about compliance with formal reporting and control expectations.
Recommendation — Track reporting obligations that affect how continuity uncertainty is disclosed. Verify that internal reporting and approval practices align with required financial disclosure standards.

Practitioner Guidance

Why practitioners should care: The going concern assumption is a judgment point that affects audit evidence, disclosure quality, and the credibility of management’s forward-looking story. If the evidence is thin, practitioners should treat the issue as a continuity assessment, not a routine compliance checkbox.

What to watch for: The strongest warning signs are recurring losses, near-term debt pressure, weak cash conversion, and dependence on future funding that has not been secured. When those factors cluster, the assumption deserves close review because the risk is usually structural rather than temporary.

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org