CovaCtrl

Blog

Discover more about risk management.

COMPLIANCE
COMPLIANCE —

ISO 27001 Auditing: Why Passing Certification Doesn't Mean Your Controls Actually Work

Every organisation with an ISO 27001 certificate can produce the certificate itself. Far fewer can show that the certification reflects how information security actually operates day to day. An ISO 27001 audit tests a sample of a management system at a single point in time, and the space between that sample and daily operations is where most control failures at certified organisations actually live.

CONTROLS
CONTROLS —

The Remediation Gap: Why the Same Audit Findings Keep Coming Back

Most internal audit programmes are measured by the quality of their findings. The implicit assumption is that a control weakness identified, accepted by management and assigned a remediation date will eventually be resolved. Data from five years of SEC filings suggests this assumption fails more often than most practitioners expect — and that the same control gaps reappear in subsequent audit cycles without the underlying cause ever having been addressed.

CONTROLS
CONTROLS —

Outsourcing a Process Does Not Outsource the Control

When a third-party provider holds a SOC 1 or SOC 2 report, many organisations treat that as sufficient evidence that the associated risks are under control. The assumption is understandable. But almost every SOC report also lists Complementary User Entity Controls that the client must implement for the vendor's assurance to hold — and most organisations never read that section. In 2026, three regulatory developments are making this gap impossible to ignore.

CONTROLS
CONTROLS —

IT General Controls and the SaaS Era: Why Coverage Has Become the New Control Failure

The traditional IT general controls framework — access management, change management, and system operations — was designed for centralised, on-premise environments where all significant systems were known, governed, and administered by IT. Most organisations no longer operate that way. The average enterprise now runs over a hundred SaaS applications, a significant proportion of which were never formally sanctioned by the function responsible for controlling them, leaving the controls designed to protect financial reporting aimed at a landscape that has fundamentally changed.

CONTROLS
CONTROLS —

Control Rationalization: Why Fewer Controls Often Means Better Assurance

Most organisations know how to add controls. After an incident, a failed audit finding or a new regulatory requirement, the response is almost always the same: add another control. The accumulated result is a control environment that is simultaneously overburdened and underperforming. The discipline of removing controls is rarely applied with the same rigour as the discipline of adding them.

COMPLIANCE
COMPLIANCE —

ESG Reporting Has a Controls Problem: Why Sustainability Data Needs the Same Rigour as Financial Data

Organisations have spent twenty years building rigorous controls around financial data. The same discipline has not followed sustainability data into regulatory disclosures. As assurance requirements escalate under CSRD and the new UK sustainability reporting standards, Internal Control over Sustainability Reporting is now the critical gap that internal audit functions are positioned — and increasingly expected — to close.

COMPLIANCE
COMPLIANCE —

SOX Under Two Watchdogs: What the SEC's New Enforcement Group and Revised PCAOB Standards Mean for Internal Controls

Regulatory pressure on SOX compliance is increasing from two directions at once. In March 2026, the SEC established a dedicated enforcement unit focused specifically on SOX violations, while the PCAOB has amended its core integrated audit standards with changes taking effect December 2026. For internal control teams, these are not abstract shifts — they redefine what sufficient evidence of a well-designed control looks like, and who will be checking.