[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"article-body-control-automation-went-backwards":3},"\nFor a decade, every GRC platform pitch has carried the same headline:\nautomate the control environment. Boards funded it, teams deployed\nit, and the natural expectation is that control automation rates\nclimbed steadily through the 2020s.\n\nThe benchmarks say otherwise. Industry surveys of SOX programmes have\nrecorded the share of automated controls drifting downward, from\naround a fifth to under that, even as average SOX compliance budgets\nclimbed into the millions per company and kept rising. Protiviti's\nlong-running SOX research has tracked both curves. Hours up, costs\nup, automation stubbornly flat to falling. More tooling, more spend,\nless automation: a result strange enough to need an explanation.\n\n## Workflow is not automation\n\nThe distinction sounds pedantic and is actually the entire story. A\ncontrol is a check that something is true: access was appropriate,\nthe reconciliation balanced, the change was approved before deploy.\nAutomating the control means the check itself runs mechanically,\nagainst the data, without a person performing it.\n\nWhat the GRC generation deployed automates everything around the\ncheck. The platform routes the testing request, chases the evidence,\nstores the screenshot, tracks the sign-off, escalates the overdue\nitem. Inside that beautifully orchestrated workflow, the control is\nstill a person, quarterly, examining a sample of 25 items out of a\nmillion, pasting an image into a form.\n\nThe consequences follow mechanically:\n\n- **Cost scales with controls, not risk.** Every new system and\n  regulation adds manual tests; each test costs analyst hours\n  forever. Budget growth is built in.\n- **Assurance stays sampled and lagged.** A quarterly sample of 25\n  says little about the other 999,975 transactions, and says it\n  months late. Control failures surface in the period-end scramble\n  or the audit, not when they happen.\n- **The workforce burns out on evidence theatre.** Skilled people\n  spend their year producing screenshots that prove a test occurred,\n  which is not the same as proving a control works.\n\n> A workflow around a manual test is a faster way to document that\n> you tested almost nothing.\n\n## The version that deserves the word\n\nContinuous control monitoring is the alternative the label always\nimplied: express the control as a logical condition over the actual\ndata, and evaluate it continuously over the whole population.\nSegregation of duties becomes a standing query against access and\ntransactions, all of them, every day. The reconciliation control\nbecomes an automated match with only genuine breaks surfaced. The\napproval-before-change control becomes a join between the change log\nand the approval log that never sleeps.\n\nThree properties separate this from the workflow generation. Coverage\nis total rather than sampled. The population, not 25 of it.\nDetection is immediate rather than quarterly. The exception fires\nwhen the condition breaks, routed to a named owner with the evidence\nattached. And the economics invert: an automated control costs its\nconstruction once, then near-nothing per period, so cost stops\nscaling with the control count.\n\nThe honest caveat is that not every control reduces to a query.\nJudgement controls, management review, estimates, tone, remain\nhuman, and should. But the bulk of a transactional control\npopulation is precisely the mechanical kind that queries handle\nbest, which is why the current automation percentages are not a\nceiling imposed by the nature of controls. They are a residue of\nbuying workflow and calling it automation.\n\n*Automate the control, not the paperwork around it.*\n\nControls as continuously evaluated conditions on one event backbone,\nwith exceptions routed to owners. That is how the Prophesee Compliance\nSuite's Risk and Controls module works. Put one of your manual\ncontrols on a query. [Start here](/contact).\n",1786833835743]