Control Decay in the Digital Enterprise

Why Organizations Pass Audits and Still Fail to Manage Risk
1. Auflage 2027
ISBN: 979-8-8688-3052-5
Verlag: APRESS L.P.

Buch, Englisch, Format (B × H): 155 mm x 235 mm

Your last audit was clean. So was the one before that. And then something happened anyway.

In modern enterprises, controls do not always fail outright. They continue to operate, pass their tests, and produce their evidence. What changes is the world that the controls were designed to govern, and it moves faster than assurance cycles were built to follow. This book introduces Control Decay: what happens when a control continues to operate and pass its tests even though the assumptions that once made it reliable no longer match current conditions.

Developed through an analysis of consequential cases, including the Silicon Valley Bank collapse, the CrowdStrike outage of July 2024, and the Boeing 737 MAX MCAS case, the book presents C-DRAFT, a diagnostic framework that names six recurring forces that explain how Control Decay develops and remains hidden: Change Velocity, Dependency Drift, Role Dilution, Automation Opacity, Framework Lag, and Testing Illusion.

Established standards help organizations design, monitor, and test controls. They leave each organization to determine whether a control’s assumptions still fit the environment it governs, and what to do if they do not. C-DRAFT addresses that specific gap. Rather than replacing established standards such as COSO, COBIT, NIST, or ISO, or the security, engineering, and risk management frameworks organizations rely on day to day, C-DRAFT provides a shared lens through which audit, security, technology, engineering, and risk can read the same control environment. The focus is relevance, not compliance expansion. Control Decay can arise in any environment that changes. What it has lacked is a unified framework that can diagnose and respond to it.

What You Will Learn

• How to detect Control Decay before failure makes it visible, using C-DRAFT – a diagnostic method that existing frameworks do not supply
• How cloud, AI, automation, and third-party dependencies accelerate Control Decay, and how to govern them without expanding compliance
• How audit, security, technology, and risk can read the same control environment through a shared lens and reduce duplicated effort

Who This Book is For

This book is written for professionals responsible for evaluating, designing, or relying on controls in modern enterprises. Internal auditors, technology auditors, cybersecurity professionals, risk managers, GRC leaders, assurance advisors, and control owners will find practical guidance, as will technology and security leaders who rely on audit and risk outcomes to judge whether controls still provide the assurance expected of them.

Zielgruppe

Professional/practitioner

Autoren/Hrsg.

Sharma, Ravi

Fachgebiete

• Interdisziplinäres Wissenschaften Wissenschaften: Forschung und Information Risikobewertung, Risikotheorie
• Wirtschaftswissenschaften Betriebswirtschaft Wirtschaftsmathematik und -statistik
• Mathematik | Informatik EDV | Informatik Technische Informatik Computersicherheit

Inhaltsverzeichnis

Chapter 1: The Illusion of Assurance.- Chapter 2: Control Decay—How Good Controls Grow Weak.- Chapter 3: Change Velocity—When Systems Move Faster Than Controls.- Chapter 4: Dependency Drift—Risk Outside Organizational Boundaries.- Chapter 5: Role Dilution—When Accountability Becomes Distributed.- Chapter 6: Automation Opacity—Controls That Work but Cannot Be Seen.- Chapter 7: Framework Lag—Compliance Without Relevance.- Chapter 8: Testing Illusion—Why Passing Audits Is Not Enough.- Chapter 9: Applying C-DRAFT—Detecting and Managing Control Decay.- Chapter 10: Aligning Internal and External Assurance.- Chapter 11: Designing Controls for Continuous Change.- Chapter 12: The Future of Assurance.

Über Autor(innen)

Ravi Sharma is a senior technology audit and risk practitioner, certified in CPA, CISA, CISSP, CRISC, CMA, AAIA, and ACMA, who has worked across the seams the book examines: between internal audit and external assurance, between security operations and audit evidence, between technology change and governance review. His work has included extensive engagement with cloud transformations, automation pipelines, identity governance platforms, SOX and regulatory assurance, and post-incident review work in complex regulated environments.

Across those engagements, he has repeatedly observed the pattern the book names: controls that pass audits while the conditions the audits were designed to verify quietly diverge from current operating reality. He has worked with internal audit teams, external auditors, security functions, technology leaders, and regulators, and has approached the same control environment through each of those lenses in turn. He has written for industry journals, contributed to professional institutes, and served in leadership roles within professional associations and university advisory councils.