An organisation's controls are assessed annually and it wants continuous assurance. What changes architecturally?

What changes

Controls become code, and their execution becomes evidence.

An annual assessment samples: it examines a subset of instances at a point in time and infers. Continuous monitoring evaluates every instance, continuously, and produces a record of each evaluation — which is both stronger assurance and cheaper to produce, since the evidence is a by-product rather than an assembly exercise.

What must be built

• Controls expressed as automated checks in the pipeline and against the running estate: dependency direction, encryption at rest, no public exposure without approval, authorisation on every endpoint, segregation enforced.
• Coverage measured against the authoritative inventory, not against the systems the control already knows about. Scope drift means a control operating perfectly on a shrinking share of the estate, which passes every assessment of the systems it covers.
• Monitoring of the control itself: execution count, coverage percentage, failure rate. A control that stopped running produces silence, and silence looks like success.
• Fail-closed behaviour, since failing open is the most common way a control becomes decorative — the scanner's credential expires, the error is swallowed, the build proceeds, and the control has not operated for months.
• A time-bounded, approved, recorded bypass, which preserves the ability to ship during a genuine infrastructure failure while making the gap visible and bounded. An invisible bypass is the problem; a visible one is a managed risk.

What it does not replace

Judgement. Automation handles the mechanical: configuration, dependency, approval enforcement, provenance. It cannot assess whether a design is appropriate, whether a risk acceptance is reasonable, or whether a novel change is safe.

The right model is automated gates for everything mechanical and human review for the significant minority, with a defined trigger for what counts as significant — so the reservation is a rule rather than a judgement made under time pressure.

The argument to the risk function

A review board has fixed capacity against unbounded demand, becomes the throughput ceiling, and gets routed around — producing worse assurance than none, because the control exists on paper and not in the system.

Automated controls prevent rather than detect, operate identically on every change — the property manual review cannot claim and sampling exists to test for — and run in seconds, so no queue forms to cause bypass.