[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"article-body-control-automation-went-backwards":3},"\nTen years of GRC spending were supposed to automate controls. What\nmany organisations actually automated was the paperwork around\ncontrols. The workflow improved. The control stayed manual.\n\nThe controls in question are the routine checks behind financial\nreporting, mandated in the US by the Sarbanes-Oxley Act. Through\nthe 2020s, industry surveys recorded the automated share drifting\ndown, from around a fifth to under that, while average compliance\nbudgets climbed into the millions per company. Protiviti's\nlong-running research tracked both curves. More tooling, more\nspend, less automation. The numbers only make sense once you see\nthat control automation and workflow automation are different\nthings, and the industry bought the second while believing it was\nbuying the first.\n\n## Workflow is not automation\n\nThe distinction sounds pedantic and is the whole story. A control\nis a check that something is true. The right people had access,\nthe accounts matched, the change was approved before it went live.\nAutomating the control means the check itself runs against the\ndata.\n\nWhat got deployed instead automates everything around the check.\nThe platform routes the testing request, chases the evidence,\nstores the screenshot, tracks the sign-off. Inside that workflow,\nthe control is still a person, quarterly, examining a sample of 25\nitems out of a million.\n\nA workflow around a manual test is a faster way to document that\nyou tested almost nothing.\n\n## What that bought\n\n- **Cost stays manual.** Every manual control consumes analyst\n  hours, period after period, so cost scales with the number of\n  controls rather than with risk.\n- **Assurance stays sampled.** A quarterly sample of 25\n  transactions says little about the other 999,975, and says it\n  months after the fact.\n- **Evidence replaces insight.** Control teams spend their year\n  proving tests happened, which is not the same as proving\n  controls worked.\n\n## The version that deserves the word\n\nContinuous control monitoring writes the control as a rule the\ndata must obey, then tests it against everything, all the time.\nThe rule that nobody should both request and approve a payment\nbecomes a standing check on every transaction, every day. The\napproval-before-change control becomes a comparison of the change\nlog against the approval log that never sleeps.\n\nCoverage becomes total rather than sampled. Detection becomes\nimmediate rather than quarterly, with each exception routed to a\nnamed owner and the evidence attached. And the economics invert;\nan automated control costs its construction once, then\nnear-nothing per period.\n\nNot every control reduces to a query. Management review, estimates\nand judgement stay human, and should. But most transactional\ncontrols are exactly the mechanical kind a query handles best.\nToday's automation percentages are not a ceiling set by the nature\nof controls. They are what you get for buying workflow and calling\nit automation.\n\nControls as continuously evaluated conditions, with exceptions\nrouted to owners, is how\n[the Prophesee Compliance Suite](/solutions/compliance/risk)\nworks. Put one of your manual controls on a query.\n[Start here](/contact).\n",1786984935415]