Insights & Trends
Continuous Compliance: The End of Audit Season
Continuous compliance ends the scramble, not the audit. What changes for auditors and customers, what stays human, and five moves to start.
Key takeaways
Continuous compliance means systems produce evidence as work happens and controls are checked on a schedule, so a firm knows its current state at any time. It ends audit season, not the audit: ISO 27001 certification and SOC 2 reports keep their independent cycle, but the evidence scramble goes and findings move from missing evidence to design and risk.
- Certification cycle
- Accredited ISO 27001 certification follows ISO/IEC 17021-1: a three-year cycle, with surveillance audits in the years between and a recertification audit before the certificate expires.
- SOC 2 Type 2
- A Type 2 report adds the CPA's opinion on whether controls operated effectively over a period. An AICPA vice president says SOC services should be done annually because things change.
- Evidence test
- Under ISA (UK) 500, auditors using entity-produced information judge whether it is reliable enough, including its accuracy and completeness. Internally generated evidence is more reliable when the related controls are effective.
- What stays human
- Scope, risk acceptance, exceptions, management review and the independent opinion stay with people. Automation collects and monitors evidence; qualified people make the risk and audit judgements.
Continuous compliance means your systems produce evidence as the work happens and your controls are checked on a schedule, so you know your current state on any given day. My claim is narrower than the slogan: continuous compliance ends audit season, not the audit. The ISO 27001 certificate and the SOC 2 report stay. The weeks of screenshots before them go.
If you run a 25 to 100-person tech firm selling into regulated customers, you know the season. Engineers spend sprint time on screenshots, and an enterprise buyer asks for proof in March when your report covers last year. Here is why I hold this view, the strongest argument against it, and what I would do about it.
Why the usual view gets continuous compliance wrong
The usual view comes in two forms. The marketing form says continuous compliance makes audits a thing of the past. The engineering form says that once checks run automatically, the auditor is a formality. Both start from a fair complaint about point-in-time audits, then promise more than the assurance system allows.
The complaint is real. I put it this way on LinkedIn in March 2026: "Your last audit told stakeholders what your governance looked like 6+ months ago. That's not assurance. That's history." Evidence is assembled for auditors, not built from how the organisation actually operates. And "a certificate says you passed. It doesn't say you're still passing."
But the fix isn't the end of the audit. The certification and attestation cycle exists for reasons that automation doesn't touch.
Accredited ISO 27001 certificates are issued under ISO/IEC 17021-1, the standard for bodies that certify management systems. It sets a three-year cycle, with surveillance audits in the years between and a recertification audit before the certificate expires. No dashboard replaces that cycle, because the certificate is the certification body's independent judgement, not yours.
SOC 2 is an attestation, not a certificate, but the logic is the same. A Type 2 report, as the Journal of Accountancy's guide to SOC 2 engagements puts it, adds "the CPA's opinion on the operating effectiveness of controls" over a period. In a 2026 Journal of Accountancy podcast, Amy Pawlicki, a vice president at the AICPA, adds that "it's also important that the services be done annually as things can change over time."
Your customer isn't buying your evidence. They're buying someone independent looking at it.
What changes when evidence is built at source
Continuous compliance changes how the audit runs, not whether it happens. When evidence is a by-product of the work, the auditor asks for a population and gets it from the system in minutes. Sampling runs over live records rather than a folder built for the visit, and findings move from missing evidence to questions of design and risk.
That last shift is the one that matters. In a reconstructed audit, a large share of the effort goes into proving that things happened at all. When access reviews, change approvals and leaver checks leave their own records, that question is answered before the auditor arrives. What's left is the harder, better conversation: is this control designed well, is it testing the right thing, and does the risk it covers still matter?
The continuous control monitoring guide covers how scheduled checks work. Automated evidence collection covers how records are captured at source. Both sit in the GRC engineering section of the Vault. Neither is the point of this piece. The point is what they do to the audit relationship: the auditor stops being a deadline and becomes a reviewer of a system that's already running.
The other change is what customers can see. A certificate is dated. A current posture, shown between audits, answers the March question without a bespoke pack.
What continuous compliance doesn't automate
Some things stay human, and they're the things that carry the risk. Scope is a decision. Risk acceptance is a decision. An exception needs someone to own it, and management review needs leaders to look at the results and act. The independent opinion is, by definition, someone else's.
ISO 27001 builds these into the standard. Clause 9.1 asks you to decide what to monitor and how to evaluate it (our guide to Clause 9.1 covers the detail). Clause 9.2 needs internal audits at planned intervals, and Clause 9.3 needs top management to review the system. Automation can feed every one of those. It can't make the judgement.
My rule is simple. Deterministic, auditable automation collects and monitors. Qualified people make the risk and audit judgements. Blur that line and you've rebuilt the scramble with better tooling.
The strongest objection: auditors won't rely on automated evidence
The objection runs like this. Auditors are paid to be sceptical, and a green dashboard is a claim, not proof. Much of the "continuous compliance" talk comes from people selling software. Even Pawlicki, in the same podcast, warns about vendors that are "looking to automate the service entirely" and promise quick turnarounds for what they call SOC certification.
It's a fair objection, and the AICPA warning is worth taking seriously. But read what it targets. She also says the AICPA fully supports "the use of technology to drive innovation, efficiency, and quality." Her concern is automating the opinion, not the evidence. That's exactly the line I'm drawing.
As for reliance, audit standards already set the test, and it isn't "manual or automated". ISA (UK) 500, the UK standard on audit evidence in financial statement audits, says that when using information produced by the entity, the auditor evaluates whether it is sufficiently reliable, including "obtaining audit evidence about the accuracy and completeness of the information." It also says internally generated evidence is more reliable "when the related controls, including those over its preparation and maintenance, imposed by the entity are effective."
So the test for system-generated evidence is whether you can show it's accurate and complete, and that the controls over producing it work. A screenshot is system-generated evidence too. It's just captured by hand, at one moment, with weaker proof of completeness. The burden doesn't disappear. It moves to showing that your evidence pipeline itself is controlled.
What to do about it
Five moves, in order:
- Start with the controls that cost the most manual evidence. List last year's evidence requests and rank them by the hours they took. What to automate first is its own question, with its own guide.
- Define evidence at source. For each of those controls, name the system record that proves it ran, and the check that shows the record is complete.
- Route drift to tickets. A failed check should become a ticket this week, not a finding at the next audit.
- Show customers a current posture. Give buyers a view they can check between audits, so the certificate isn't the only answer you can give.
- Keep the human calendar. Risk acceptance, exceptions, internal audit and management review stay scheduled and owned. A compliance monitoring programme gives them a rhythm.
None of this cancels the audit. It changes what the auditor finds when they arrive.
Audit season ends. The audit stays.
Governance has always been treated as a cost centre. Continuous compliance can make it something customers can see. The certificate and the report still matter, but the scramble before them doesn't have to.
If you want to see how the checks behind this work, start with the continuous control monitoring guide.
Frequently asked questions
Continuous compliance is an operating model in which systems produce compliance evidence as work happens and controls are checked on a schedule. Continuous control monitoring is one part of it: the scheduled checks. The model also covers where evidence comes from, how drift is handled and who owns each judgement.
No. ISO 27001 certification keeps its three-year cycle of surveillance and recertification audits. On SOC 2, only a Type 2 report gives an opinion on whether controls operated effectively over a period; a Type 1 covers the system description and control design. Continuous compliance makes the evidence for either easier to produce. It doesn't replace the independent review.
No. Continuous auditing usually means auditors, often internal audit, running ongoing analytics over an organisation's data. Continuous compliance is run by the organisation itself: its systems produce the evidence and its people own the judgements. An external auditor then reviews that system.
