CovaCtrl

Blog

Discover more about risk management.

CONTROLS
CONTROLS —

Outsourcing a Process Does Not Outsource the Control

When a third-party provider holds a SOC 1 or SOC 2 report, many organisations treat that as sufficient evidence that the associated risks are under control. The assumption is understandable. But almost every SOC report also lists Complementary User Entity Controls that the client must implement for the vendor's assurance to hold — and most organisations never read that section. In 2026, three regulatory developments are making this gap impossible to ignore.

CONTROLS
CONTROLS —

Control Rationalization: Why Fewer Controls Often Means Better Assurance

Most organisations know how to add controls. After an incident, a failed audit finding or a new regulatory requirement, the response is almost always the same: add another control. The accumulated result is a control environment that is simultaneously overburdened and underperforming. The discipline of removing controls is rarely applied with the same rigour as the discipline of adding them.

COMPLIANCE
COMPLIANCE —

ESG Reporting Has a Controls Problem: Why Sustainability Data Needs the Same Rigour as Financial Data

Organisations have spent twenty years building rigorous controls around financial data. The same discipline has not followed sustainability data into regulatory disclosures. As assurance requirements escalate under CSRD and the new UK sustainability reporting standards, Internal Control over Sustainability Reporting is now the critical gap that internal audit functions are positioned — and increasingly expected — to close.

COMPLIANCE
COMPLIANCE —

SOX Under Two Watchdogs: What the SEC's New Enforcement Group and Revised PCAOB Standards Mean for Internal Controls

Regulatory pressure on SOX compliance is increasing from two directions at once. In March 2026, the SEC established a dedicated enforcement unit focused specifically on SOX violations, while the PCAOB has amended its core integrated audit standards with changes taking effect December 2026. For internal control teams, these are not abstract shifts — they redefine what sufficient evidence of a well-designed control looks like, and who will be checking.